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Abstract 

This paper studies the problem of secure communication over the broadcast channel with receiver side 
information under the lens of individual secrecy constraints. That is, the transmitter wants to send two 
independent messages to two receivers which have, respectively, the desired message of the other receiver 
as side information, while keeping the eavesdropper ignorant of each message (i.e., the information leakage 
from each message to the eavesdropper is made vanishing). Building upon one-time pad, secrecy coding, 
and broadcasting schemes, achievable rate regions are investigated, and the capacity region for special 
cases of either a weak or strong eavesdropper (compared to both legitimate receivers) are characterized. 
Interestingly, the capacity region for the former corresponds to a line and the latter corresponds to a square 
with missing corners; a phenomenon occurring due to the coupling between user’s rates. Moreover, the 
individual secrecy capacity region is also fully characterized for the case where the eavesdropper’s channel 
is deterministic. In addition to discrete memoryless setup, Gaussian scenarios are studied. For the Gaussian 
model, in addition to the strong and weak eavesdropper cases, the capacity region is characterized for the low 
and high SNR regimes when the eavesdropper’s channel is stronger than one receiver but weaker than the 
other. Remarkably, positive secure transmission rates are always guaranteed under the individual secrecy 
constraint, unlike the case of the joint secrecy constraint (i.e., the information leakage from both messages 
to the eavesdropper is made vanishing). Thus, this notion of secrecy serves as an appropriate candidate for 
trading off secrecy level and transmission rate; making secrecy more affordable but still acceptable to the 
end user. 


I. Introduction 

A. Background 

The broadcast channel is a fundamental communication model that involves transmission of independent 
messages to different users. However, the broadcast nature makes the communication very susceptible to 
eavesdropping. Therefore, it is desirable to offer a reliable communication with a certain level of security 
guarantee, especially for ensuring sensitive information to be protected from unauthorized parties. 
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The problem of secure communication from an information theoretic point of view was hrst studied by 
Shannon [1]. In this work, a cipher system was introduced under the assumption that the transmitter and the 
intended receiver share a secret random key which is out of the eavesdropper’s knowledge. For the purpose 
of a secure communication, the message is first encrypted into a ciphertext before being transmitted, and it 
is assumed that the eavesdropper has full access to the ciphertext as the intended receiver. A cipher system 
with perfect secrecy demands that knowing the ciphertext, however, gives no clue about the message. Such a 
perfect cipher system is shown to be possible via the so-called one-time pad scheme [1] (previously porposed 
by Vernam [2]), provided that the secret key is sufficient to randomize the message. 

Wyner, in his seminal paper [3], introduced the wiretap channel, where he addressed the problem of secret 
message transmission from a transmitter to a legitimate receiver (without sharing keys beforehand) over a 
degraded broadcast channel in the presence of an eavesdropper. It is shown that the secure communication 
is still possible when the eavesdropper observes a degraded version of the legitimate receiver’s observation. 
The fundamental limit of secure communication, i.e., secrecy capacity, is defined to be the maximum rate 
under a weak secrecy constraint, where the rate of information leaked to the eavesdropper is made vanishing. 
Later on, Csiszar and Korner [4] extended Wyner’s work by considering a setup of transmitting secret and 
common message over a general broadcast channel, and provided a single-letter characterization of the 
secrecy capacity. Notably, the secrecy capacity results hold also under a strong secrecy constraint, where the 
total amount of information leaked to the eavesdropper is made vanishing, as demonstrated in [5]. 

For those wiretap channels where the legitimate receiver does not have any advantage over the eaves¬ 
dropper, interestingly, Maurer [6] demonstrated that it is still possible to achieve a positive secret rate if a 
public feedback channel is made available. In parallel, Csiszar and Ahlswede [7] recognized that correlated 
source observations could be explored for generating secret key that could be used further for secret message 
transmission via one-time pad. These offer alternative solutions to achieve information theoretic secrecy, 
which are especially interesting in cases that the legitimate users have no advantage against the eavesdropper 
on the communication channels. 

Inspired by these pioneering works, there has been a body of growing literature studying the problem of 
secret message transmission and/or secret key generation by exploring the resources available in different 
settings. Extensive types of resources have been taken into account in order to establish secret commu¬ 
nications without much sacrihce, or turn the disadvantages into advantages so as to make the impossible 
possible or even improve the overall performance. Such resources include channel state information [8]-[12], 
side information [13], feedback [14]-[18], correlated sources [19]-[21] or shared keys [22]-[24], and so on. In 
the meantime, the channel, still serves as one of the most significant resource for secure communication. 
Several communication channels of particular practical interest have received intense research attention. 
Instances include but not limited to the broadcast channels [25]-[28], multiple access channels [29], two-way 
channel [30], [31], the interference channels [32], [33], and compound channels [34]. 
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B. Contributions 

In this paper, we consider the problem of secure communication over the broadcast channel with receiver 
side information (BC-RSI). The model is different from the wiretap channel with side information due to the 
broadcast nature of the communication channel. That is, in this model, the transmitter wants to send two 
independent messages to two receivers which have, respectively, the desired message of the other receiver 
(already available in their possession, e.g., due to previous communications) as side information. (See Fig. 
1.) This is a simple setup of a general scenario, which consists of more than two legitimate receivers, each 
having a piece of partial information about the transmitted message. In the following, we summarize the 
main contributions of the paper: 

• The linear deterministic model is studied and corresponding individual secrecy capacity region is char¬ 
acterized. Due to its relevance to the corresponding Gaussian case, study of this specific model provides 
insight into the individual secrecy capacity region of Gaussian case especially in the high SNR regime. 

• To investigate the fundamental limits of communication under individual secrecy constraints, con¬ 
structions building upon one-time pad, wiretap coding, superposition coding, and Marton’s coding are 
proposed. 

— First construction, referred to as secret key approach, utilizes side information at receivers as secret 
keys of one-time pad signals, which further is encoded as cloud centers in broadcast coding schemes. 
This approach is shown to be capacity achieving for a strong eavesdropper (compared to both 
legitimate receivers). 

— Secret key approach is extended with secrecy coding, where the one-time pad signal is utilized as a 
part of the randomization to confuse the eavesdropper (i.e., to limit her ability to obtain information 
regarding each message). This approach is shown to be capacity achieving for a weak eavesdropper 
(compared to both legitimate receivers). 

— The proposed superposition coding can be considered as an extension of secret key approach and 
combined secret key and secrecy coding approach. It takes advantage of the rate splitting of one¬ 
time pad signals such that they serve for two distinct purposes: I) as a cloud center; and 2) as a 
part of randomization within the satellite codewords to confuse the eavesdropper. Also, it is shown 
that the suggested rate splitting is sufficient within superpostion coding since further rate splitting 
does not improve the established region. Remarkably, superposition coding is shown to be optimal 
for special cases of either a strong or weak eavesdropper (compared to both legitimate receivers), 
and in case that the eavesdropper has a deterministic channel. 

— The proposed Marton’s coding approach is built on the superposition coding but with one additional 
coding layer that employs Marton’s coding. The idea is to further explore the advantage of rate 
splitting at the encoding phase (with introduction of joint distributed satellite codewords which 
carry independent message pieces intended for each legitimate receiver); and at the decoding phase 
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only the individual satellite codewords will be decoded. As a result, a general achievable individual 
secrecy rate region is established, which not only includes but further improves the region obtained 
by superposition coding approach. The improvement is demonstrated for the mixed case where the 
eavesdropper’s channel is weaker than one of the legitimate receivers channels but stronger than 
the other. 

— As a by-product, two achievable joint secrecy rate regions are also obtained by the proposed 
superposition coding approach and Marton’s coding approach, respectively; in which the former is 
included and potentially improved by the latter, i.e., Marton’s coding approach. 

• Gaussian model is studied. And, in addition to strong and weak eavesdropper scenarios, the capacity 
region for low and high SNR regimes are characterized for the mixed case when the eavesdropper is 
stronger than one legitimate receiver but weaker than the other. 

C. Related Work 

Our model can be thought of as a broadcast phase of a relay network after a multiple access phase 
where the nodes transmit their messages to the relay in the first phase. Remarkably, this two-way relay 
setting simply illustrates how the information are shared in today’s networked world. To maximize the 
broadcasting throughput, the technique employed at the relay node is very relevant to network coding. As 
demonstrated in [35], the relay node (i.e., the transmitter in our model) can broadcast the XORed messages. 
Then, the legitimate receivers, utilizing the side information they have, can decode their intended message. 
The broadcasting capacity region (Fig. 1 without an eavesdropper) is characterized in [35]. 

In addition to the broadcasting to share information in the most efficient way, the secrecy aspect of 
the communication has been a growing concern. Considering the existence of an external eavesdropper in 
the model of the broadcast channel with receiver side information (BC-RSI), the authors in [36] proposed 
achievable rate regions and outer bounds subject to a joint secrecy constraint, whereby the information 
leakage from both messages to the eavesdropper is made vanishing. Differently from [36], we focus on the 
problem under individual secrecy constraints that aims to minimize the information leakage from each 
message to the eavesdropper. Other relevant works include [37]-[40]. The work [37] considered transmitting 
common and private messages to each user for the BC with side information model in addition to transmitting 
a confidential message to one of the users while treating the other as an eavesdropper. The same setting 
without common messages was considered in [38] and the secrecy capacity was characterized. Recently, in 
a parallel work [39], [40], Mansour et al. considered discrete memoryless broadcast channels with degraded 
message sets and message cognition. The model in [40], when the common messages are removed and 
individual secrecy constraint is imposed, reduces to the model considered in this paper. In particular, the 
scenarios of weak and stronger eavesdroppers (as characterized in Theorem 4 and Theorem 6 here) overlaps 
with the corresponding propositions in [40], in which the authors consider more capable/less noisy scenarios 
as well. Our initial results on this topic are presented in [41], [42], and, in addition to stronger/weaker 
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eavesdropper cases, we focus on other DMC models, deterministic channels, and Gaussian scenarios for 
BC-RSI with individual secrecy constraints in this paper. 

Although the individual secrecy constraint is by definition weaker than the joint one, this notion never¬ 
theless provides a security level that keeps each legitimate receiver away from non-negligible information 
leakage on its intended message, therefore acceptable to the end user. In addition, a joint secrecy constraint 
can be difficult or even impossible to fulfill in certain cases. For instance, when the eavesdropper has the 
same or a better channel observation than at least one of the legitimate receivers, imposing joint secrecy 
constraints result in a vanishing communication rate to the respective receiver. In this paper, we devote 
a particular attention to these mixed scenarios, where the eavesdropper can be stronger than one receiver 
but weaker than the other. In such cases, individual secrecy serves as a practical security solution that is 
attainable. In fact, such a weaker security constraint is shown to be preferable in large-scale networks. For 
instance, this notion has the same spirit as the concept of weak security as defined in [43] to guarantee 
that the eavesdropper is unable to get any meaningful information about the source in a multicast network 
scenario. In addition, a similar security criterion is considered to be sufficient for distributed storage systems. 
For instance, one can find its application in the design of secure cloud storage systems as proposed in [44], 
[45]. 


II. System model 

Consider a discrete memoryless broadcast channel given by p{yi,y 2 , z\x) with two legitimate receivers 
and one passive eavesdropper, as shown in Fig. 1. The transmitter aims to send messages mi,m 2 to the 
legitimate receiver 1,2, respectively. Suppose x" is the channel input to convey mi,m 2 in n channel uses, 
whilst yi (at receiver I), y^ (at receiver 2) and z" (at eavesdropper), are the channel outputs. Besides, m 2 
(available at receiver 1) and mi (available at receiver 2) serve as side information that help to decode the 
desired message. (Unless otherwise specified, we use capital letters for random variables, the corresponding 
calligraphic letters for their alphabets and small cases for their realizations.) 


mi 

m2 


m2 



Fig. 1: BC-RSI with an external eavesdropper. 
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Encoder employed by the transmitter is a mapping / : Mi x M 2 —t where toi £ Adi, m 2 £ M 2 , 

and £ A”". (Here, the channel input alphabet is X). Decoder employed at receiver i is a mapping 
gi '■ yp X Mj —>■ Mi, where j ^ i, and yf £ yp for i = 1,2. (Here, the channel output alphabet at receiver 
i is yi.) Denote the average probability of decoding error at receiver i as Pe,i = Pr{mi 7 ^ gi{yp,mj)} with 
j 7 ^ i. The rate pair (i?i,ii 2 ) is said to be achievable, if for any e > 0, there exists an encoder-decoder tuple 
( 1 , 91 , 92 ) such that 


-H{MP >R, - e 

(1) 

n 

Pe,i <e 

(2) 

<e, 

(3) 


for i = 1,2 (and, for sufficiently large n). Note that (1) corresponds to the targeted transmission rate-, (2) 
corresponds to the reliability constraint at the legitimate receivers; while (3) corresponds to the individual 
secrecy constraints against the eavesdropper. If the coding scheme fulfils a stronger condition that 


-/(Mi,M 2 ;Z”) <e, (4) 

n 

then it is said to satisfy the joint secrecy constraint. Clearly, the joint secrecy constraint implies the individual 
secrecy constraints. 


III. An illustrative example 


Ml 



Fig. 2: Secure communication over 1-to-fc broadcast channel with receiver side information. 

In this section, we motivate the individual secrecy constraint by using the scenario of \-to-k broadcasting as 
shown in Fig. 2. The model consists of one transmitter, k legitimate receivers, and one passive eavesdropper. 
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The transmitter aims to broadcast k information bits C/* = {Ui, U 2 , • • • , Uk) to k legitimate receivers with 
Ui ~ Bern(l/2); whilst each receiver i holds already one piece of information Ui as side information. Suppose 
that is encoded into X" = {Xi,X 2 , ■ ■ • ,Xn) and consider that this channel input is transmitted over 
noiseless channels. Then, for the purpose of broadcasting, each legitimate receiver i (which holds Ui and 
receives X") shall be able to recover the fc — 1 information bits U^\{Ui}, i.e., 

HiU’^lX^^Ui) = 0. (5) 


Thus, we have 


H{U'^\X^) = H{U'^, C/i|X”) = HiU.lX'^) + H{U'^\X'^, Ui) 

nmx^). 


( 6 ) 


Let us now consider the secrecy aspect of broadcasting by imposing the joint and individual secrecy 
constraints, respectively. We note that the eavesdropper also receives a perfect copy of X". 

1) For the joint secrecy constraint, we have that 

= £?([/'=). (7) 

Recall ( 6 ). We obtain 

iJ(C/'=|X”) = HiUilX'^) < H{Ui) < H{U^), 

where the last strict inequality follows since Ui ~ Bern(l/2). Thus, equality in (7) is not possible. That is, 
for this example, no broadcasting scheme could fulfill the joint secrecy constraint. 

2) For the individual secrecy constraint, we have that 

H{U^\X^) = H{Ui), ioT l<i<k. (8) 

Suppose there is a coding scheme that fulfills both purposes of broadcasting, i.e., (5), and the individual 
secrecy, i.e., ( 8 ). Then, we have 

X”) = H{Ui, X^) + H{Ul-\ C/r+i|[/„ X") 

= +iJ(C/*|X”) 

^=^i7(X”)+i7(C/0, (9) 

where (a) is due to (5); and (b) is due to ( 8 ). Using i7([/^,X") > H{U^) in (9), we obtain that 

i7(X”) > i7(C/'=) - H(Ui) = k-l. 

So to say, the optimal encoding scheme (with respect to the overall transmission rate k/n) from U^ to X" 
is such that iJ(X") = k — 1. Thus, to obtain the optimal rate, one shall take n = k — 1. This is feasible. In 
fact, there are many coding schemes that could achieve this. One of the options is to take 


Xi = ui (B Mi+i, for 1 < i < k — 1. 
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The decoding at each receiver i is straightforward. Since Ui is available at receiver i as side information, it 
could first help to recover ui by ui = Xi-i © Ui if i > 1; and then sequentially recover Uj by uj = xj-i © ui 
for j ^ l,i. And, the transmission rate Ri to each receiver i, for 1 < i < k, is equal to 1, since k — 1 bits 
are received in n = fc — 1 channel uses. Noting that the capacity for a binary noiseless channel is one, we 
conclude that the above scheme actually achieves the individual secrecy capacity for all receivers. 

The following insights immediately follow from this example: 

• Joint secrecy might be impossible to achieve. 

• Individual secrecy could be the highest secrecy level to offer (as shown in ( 6 ) on the equivocation at 
the eavesdropper). 

• Individual secrecy could be achieved without any rate degradation (as compared to the capacity region 
without security constraints)! 

In fact, joint secrecy could be impossible for a more general set-up as demonstrated in the following 
proposition. 

Proposition 1. For the communication model as shown in Fig. 1 under the joint secrecy constraint, any 
rate pair (i?i,i? 2 ) G K’*' is infeasible if the channel to at least one of the receivers is more noisy than the 
channel to the eavesdropper. 

Proof: Assume that receiver 2 receives Yf' as a more noisy version of Z'^, the channel output at the 
eavesdropper. From the following analysis, we show that i ?2 > 0 is not possible. 

nR2 = H{M2) = I{M2-, ) + H{M2\Mi,Yff) 

§ /(M 2 ; Y:^\Mi) + ne' < /(Ml, M 2 ; Yf^) + ne' 

(b) 

< /(Mi,M 2 ;Z”) +ne' 

(c) 

< n(e + e ), 

where (a) is due to Fano’s inequality (implying that //(M 2 |Mi, F 2 ") < for some e' 0 as n —>• 00 ) and 
the fact that /(M 2 ; Mi, F 2 ") = /(M 2 ; Mi) +/(M 2 ; Yf^lMi) = /(M 2 ; Yf^lMi) as Mi and M 2 are independent; 
( 6 ) is due to I{Mi, M 2 ',Yf^) < /(Mi, M 2 ; .^"') which follows from the fact that receiver 2 has a more noisy 
observation Yf^ than the eavesdropper’s observation Z"; and (c) is due to the joint secrecy constraint (4). 

This implies that R 2 e + e', which is arbitrarily small for an arbitrarily small Pe ,2 (i-e., e') and an 
arbitrarily small information leakage rate e to the eavesdropper. ■ 

Nevertheless, an achievable rate region was established in [36] for the BC-RSI under joint secrecy con¬ 
straint. In the following sections, we will focus on deriving the individual secrecy capacity or achievable 
rate regions for different BC-RSI models. In particular, we will start with a specific linear deterministic 
case, where we establish the individual secrecy capacity region. Then, we will address the general discrete 
memoryless model, where we obtain achievable rate regions with characterization of the capacity region in 
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special cases. Finally, we look into the Gaussian case and obtain inner and upper bounds for the individual 
secrecy capacity region. 


IV. Linear Deterministic BC-RSI 

Motivated by the success of the linear deterministic approach [12], [46] in approximating the (secrecy) 
capacity region within constant bits regardless of the received signal-to-noise ratio and its relevance par¬ 
ticularly in the high SNR regime, we first take a look at the linear deterministic broadcast channel [46] 
with receiver side information. In this specific model, the received signals at the legitimate receivers and the 
eavesdropper are given by 

Yi = V, 

Y2 = V, (10) 

Z = V, 

where X is the binary input vector of length q = max{ni, n 2 , Re}; D is the q x q down-shift matrix; ni, n 2 
and rie are the integer channel gains of the channels from the transmitter to receiver 1, receiver 2, and the 
eavesdropper, respectively. Note that 

1) as q = ni > n 2 > Ue, the channel is degraded in the manner that X ^ Yi ^ Y 2 ^ Z forms a Markov 
chain; 

2) as q = ni > He > n 2 , the channel is degraded in the manner that X ^ Yi ^ Z ^ Y 2 forms a Markov 
chain; 

3) as q = Ue > ni > n 2 , the channel is degraded in the manner that V —>■ Z —> Yi —>■ 12 forms a Markov 
chain. 

In all cases, we have the following theorem: 

Theorem 2. The individual secrecy capacity region of the linear deterministic broadcast channel with receiver 
side information is the set of the rate pairs (i?i,i? 2 ) defined by 

Ri < minjni, [ni — Ue]'^ + R 2 }', 

R 2 < min{n2, [R2 — Re]'*’ + Ri}, 

where [a]’*' = max{0,a}. 

Proof: The converse follows directly from [35, Theorem 1] and Proposition 21 in Appendix A, where 
the former is the capacity region of the BC-RSI without any secrecy constraints; and the latter is an upper 
bound of the secrecy capacity region of BC-RSI. 

The achievability follows by considering different scenarios, each is classified according to the relation 
between the channel gains ni,n 2 ,ne, and the relation between the rates i?i,i? 2 - For a given scenario, we 
consider the construction of the codeword A as a function of mi, m 2 - Note that, at the receiver side, according 
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to the system input-output relation as defined in (10), receiver 1 receives the first ni bits of X, receiver 2 
gets the first n 2 bits of X, and the eavesdropper gets the first rie bits of X. This holds for all scenarios. 
In order to achieve a reliable and secure communication under the individual secrecy constraint, X should 
be designed in such a way that both legitimate receivers could decode the desired message with the help 
of the side information (i.e., the other message); while the eavesdropper can only observe bits either in the 
form of TOi © m 2 , or mixture of part of the messages, and/or random bits. This gives no information on mi 
and m 2 individually. In Appendix B, we provide a specific coding scheme for each scenario, achieving the 
corresponding individual secrecy capacity region. Putting all pieces together establishes the achievability of 
the stated region. ■ 





(a) ni > n 2 > rte (b) ni > > n 2 (c) > ni > n 2 

Fig. 3: Individual secrecy capacity region of the linear deterministic BC-RSI 

The individual secrecy capacity region of the linear deterministic BC-RSI is depicted in Fig. 3. We remark 
that the capacity region is 

• a rectangle with two missing corners in case of ni > n 2 > Ue', 

• a parallelogram in case of ni > Ue > n 2 ', and 

• a line in case of rie > ni > 71 , 2 . 

Compared to the capacity region of the BC-RSI (following from [35, Theorem 1], this region is given by 
Ri < ni and R 2 < n 2 as shown in Fig. 3), the missing parts reflect the loss in the transmission rates due to 
the individual secrecy constraints. And, as the eavesdropper gets stronger, the loss increases. Nevertheless, 
in the worst case, positive secrecy rate pairs are still possible under the individual secrecy constraint (as 
shown in Fig. 3c), unlike the case under the joint secrecy constraint (as demonstrated in Propostion 1). 

V. Discrete Memoryless BC-RSI 

In this section, we consider the discrete memoryless BC-RSI with an external eavesdropper (Fig. 1). When 
none of the secrecy constraints are taken into account, this model reduces to discrete memoryless BC-RSI, 
for which the capacity region is given by the union of rate pairs (i?i, R 2 ) satisfying Ri < I{X;Yi) for i = 1,2, 
where the union is taken among all possible input probability distributions p{x) [35, Theorem 1]. Here, we 
focus on coding schemes that can achieve not only reliability but also (individual) secrecy for this model. In 
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particular, we investigate to what extend this capacity region has to be modified in order to accommodate 
(individual) secrecy. 

In order to investigate the fundamental limits of communication under individual secrecy constraints, 
we utilize coding approaches including one-time pad, wiretap coding, superposition coding, and Marton’s 
coding, which have been proposed for communication scenarios such as Shannon’s cipher system, wiretap 
channel, and broadcast channel [47]. The key ingredient of our proposed schemes is the utilization of side 
information at receivers as secret keys of one-time pad signals, which further is encoded as cloud centers in 
broadcast coding schemes. That is, one-time pad signals are constructed such that they can be decoded at 
both receivers, which can then extract their desired information utilizing the side information, whereas the 
eavesdropper will be left with full ambiguity regarding the information content for each message individually. 
We refer this signaling technique as the secret key approach. 

As detailed in this section, we observe, for the case of a strong eavesdropper, that the secret key approach 
(i.e., coding via one-time pad by mixing the messages) is the best one can do; while, in case of a weak 
eavesdropper, the combined secret key and secrecy coding approach is required in order to achieve higher 
rates. (Here, we use the phrase secrecy coding in order to refer to the extension of wiretap coding technique 
to our broadcast model, where both users randomize their signals in order to confuse the eavesdropper.) 
After a characterization of achievable rates and special case capacity results with these strategies, we detail a 
universal approach by employing superposition coding and Marton’s coding to establish (general) achievable 
individual secrecy rate regions. 

A. Secret key approach and the capacity region for BC-RSI with a stronger eavesdropper 

Consider the symmetric secret rate region where Ri = R 2 = R, i.e.. Mi and M 2 are of the same entropy. 
Under these conditions, communicating the message Mi © M 2 readily provides individual secrecy, i.e., the 
following rate region is achievable. 

Proposition 3. Any (i?i,i? 2 ) G satisfying 

Ri = R 2 < min{/(X; W), I{X; Y 2 )}, (11) 

for any p{x) is achievable. 

Proof: Randomly generate 2"^ codewords x" according to p{x). Given {mi,m 2 ), send x'^{mk) with 
mfc = TOi © m 2 to the channel. See Fig. 4 for the construction of X". Both receivers can decode reliably by 
utilizing their side information to extract intended messages if Ri = R 2 < rnm{I{X;Yi), I{X;Y 2 )}. For the 
secrecy of Mi, i = 1,2 we have 

I{Mp, Z") < I{Mp, Z”, Mk) = I{Mp, Mk) = 0, (12) 

where (a) is due to the non-negativity of the conditional mutual information, i.e., I{Mi-, Mk\Z'^) > 0; (b) 
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is due to Markov chain Mi Mk , i.e., I{Mi] Zn\Mk) = 0; and (c) follows as Mi is secured with a 

one-time pad Mj {j ^ i) in Mk- ■ 

mi : 

m2 : 


Fig. 4: Secret key approach: Encoding. 

Note that the above achievable region is limited by the capacity of the worse channel of the legitimate 
receivers. Nevertheless, it serves as the individual secrecy capacity region when the eavesdropper has an 
advantage on the channel over both legitimate receivers. 

Theorem 4. If the channels to the legitimate receivers are degraded with respect to the channel to the 
eavesdropper, then the individual secrecy capacity region is given by the union of non-negative rate pairs 
satisfying 

Ri^R2<min{IiX-,Yi),IiX-,Y2)}, (13) 

where the union is taken over p{x). 

Proof: The achievablity follows from the proof of Proposition 3. Here, we detail the converse. 
ni?i = H{Mi) = /(Mi; M 2 , Yf^) + //(M 1 IM 2 , Yf^) 

< /(Mi; r”|M 2 ) -k ne' < /(Mi, M 2 ; Yi”) -k ne'; 

(b) ^ 

< /(X"; Y") + ne' = 

(d') (^) 

= nI{XQ-, Yi^qIQ) -k ne' < nI{X-,Yi) -k ne'; 
and, continuing from (a), we have 

nRi < /(Mi; Yi”|M 2 ) -k ne' < /(Mi, M 2 ; Y”) -k ne' 

/(Ml, M 2 ; Y") + ne' < /(M 2 ; Y’^|Mi) + n(e' + e) 

< H{M 2 ) -k n(e' -k e) *■= n /?2 + n(e' -k e) 

(*) 

< n/(X; Y 2 ) -k n(e' -k e) 

where (a) is due to Fano’s inequality and the fact that /(Mi; M 2 ) = 0; (6) is due to Markov chain (Mi, M 2 ) ^ 
X" —>■ Y"; (c) follows as the channel is memoryless; {d) is by introducing a time-sharing random variable Q 
which is uniform over 1, 2,..., n; (e) is by taking X = Xq, Yi = Yi_q; (/) is due to the channel degradedness. 


mi 

m2 


mi © m2 


nR 
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Fig. 5: Individual secrecy capacity region in case of a strong eavesdropper. 


i.e., Markov chain (Mi, M 2 ) Z'^ F"; {g) is by the individual secrecy constraint (3); {h) is due to 

H{M 2 ) = ni? 2 ; and (i) is derived by applying a proof similar to nRi < nI{X;Yi) + ne' and by taking F 2 = 
F 2 ,q- At this point, from (/i), we have i?i < R 2 ; and Ri < min{/(X;Fi),/(X;^ 2 )}- By symmetry, we have 
i ?2 < Ri and i ?2 < min{/(X; Fi),/(X; F 2 )}. Thus, we establish that Ri = R 2 < min{J(X; Fi),/(X; F 2 )}. 

■ 

The individual secrecy capacity described in Theorem 4 is depicted in Fig. 5. That is, in case of a strong 
eavesdropper, the best transmission strategy is to send the one-time pad of the messages to both receivers, 
where both of them could recover its desired message with the help of side information; while the eavesdropper 
gets only the mixed copy, which gives no clue for each message individually. 

B. Combined secret key and secrecy coding approach and the capacity region for BC-RSI with a weaker 
eavesdropper 

Although the secret key approach is optimal in case of a strong eavesdropper, this scheme can be strictly 
suboptimal for other scenarios. In fact, a counter-example follows from the linear deterministic model, for 
the case where the eavesdropper is weak. In general, consider channel inputs p{x) such that I{X;Z) < 
min{/(X; Fi), /(X; F 2 )}. We show in this section that, asymmetric rate pairs beyond the secret key approach 
can be achieved if we combine secret key with a secrecy coding approach. That is, besides using the receiver 
side information as secret key, one can further take the advantage over the channel against the eavesdropper 
by employing secrecy coding approach [3], [4]. First, we have the following proposition. 
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Proposition 5. Any G K.'*’ satisfying 

I{X;Z) <Ri<IiX;Yi) 

I{X-Z)<R^<I{X-Y^) 

for p{x) such thatI(X;Z) < min{/(X; li),/(X; y 2 )} is achievable. 

Proof: Rate splitting: Assume that i ?2 < Ri- As illustrated in Fig. 6, we split Mi into two parts, 
i.e., Ml = {Mik, Alls) with Mik of entropy ni? 2 , the same as M 2 ; whilst Mis of entropy nRis- Note that 
Ri = Rik + Ris- 


nRik nRis 


.-, 


mik 

mis 



1712 






nR2 


Fig. 6: Combined secret key and secrecy coding approach: Rate splitting. 


Codebook generation: Randomly generate 2^^^ codewords x" according to p{x). Throw them into 
bins [47] and index them by x^{ik,iis) with {ikAis) G [1 : 2"^^] x [1 : 2"^^*]. 

Encoding: To send messages {mi, m 2 ), choose x'^{mk,mis) with mk = mik © m 2 and transmit it to the 
channel. The choice of the codeword a;” for given (mi, m 2 ) is illustrated in Fig. 7. 


X 


n . 


ni ?2 


mik © m2 

mis 

-V- 

nRis 


nRi 


Fig. 7: Combined secret key and secrecy coding approach: Encoding 


Decoding: Receiver 2 can decode m^ reliably using typical set decoding if 

R2<I{X-,Y2) (14) 

with the knowledge of mi, and thus extract m 2 . Receiver 1 can decode both mk and mis if 

Ri<I{X-,Yi) (15) 

and extract mik from the former with the knowledge of m 2 . 

Individual secrecy: At the eavesdropper, we see that Mik is secured by capsuling with M 2 as a one-time 
pad (thus M 2 is also secured as in Section V-A), while Mis is secured by using secrecy coding for classical 
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wiretap channels under the condition that 

R2>I{X;Z). (16) 

More specifically, the secrecy of M 2 follows from 

/(M2; Z”) < /(M2; Z", Mfc, M,s) = /(M2; Mfe, Ml,) = 0. 

And, the secrecy of Mi is shown as follows. Since R 2 > I{X;Z), for a fixed ii,, one can further bin the 
codewords x'^ and index them as x^{ikr, iks,iis) with ik = {ikr, iks) G [1 : x [1 : 

as illustrated in Fig. 8. Correspondingly, split Mfc = (Mfcr,Mfc,). We have 


KinI(X\Z) 


'ikr 

'iks 

ils 

' -V-^ 



ni?2 nR\s 


Fig. 8: secret key and secrecy coding approach: Secrecy analysis. 


M(Mi„ Mks\Z'^) =H{Mu, Mfc„ A"|Z”) - M(A’^|Mi„ M^,, Z^) 

> Mfc„ A", Z^) - H{Z^) - nei 

=M(A”) + HiZ^lX'^) - H{Z^) - nei 
(b) 

>nRi + nH{Z\X) — nH{Z) — nei 
>H(Mis,Mks) - nS{e), 

where (a) follows as M(A"|Mi,, M^,, Z^) < nei due to Fano’s inequality and that the eavesdropper can de¬ 
code A" reliably by using typical set decoder, given (M^,, Mi,, Z”); (&) is due to the fact that iJ(A") = nRi; 
H{Z"\X") = nH{Z\X) since the channel is memoryless; and H{Z'^) = X)iLi H{Zi\Zl~^) < H(Zi) = 
nH{Z); (c) follows that H{Mis,Mks) = nRis + n{R 2 —I{X\Z) + e) = nRi—nI{X\Z) + ne and (5(e) = ei-|-e. 

Above inequality implies /(Mi,; Z”) < nS(e). Besides, due to Markov chain Mik —>■ (M^, Mi,) —>• Z^, we 
can bound /(Mi^; Z”|Mis) < /(Mi^; Z", Mi,, Mfc) = /(Mi/.; Mfc, Mi,) = 0. Therefore, we obtain 

/(Mi; Z") = /(Ml,; Z") + /(Mifc; Z"|Mi,) < nS(e). 

This concludes the proof of the individual secrecy. 

Achievable rate region: Combining the sufficient conditions for reliable transmission to both receivers, i.e., 
(14) and (15), and the condition for individual secrecy, i.e., (16), we obtain 

/(A;Z) <R2<I{X-Y2) 

R 2 <Ri<I{X-Yi), 
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Fig. 9: Individual secrecy capacity region in case of a weak eavesdropper. 


as the achievable rate region for the case i ?2 < Ri- Furthermore, one can apply a similar proof to establish 
the rate region for the case i ?2 > Ri- Putting them together completes the proof of the proposition. ■ 

Theorem 6. If the channel to the eavesdropper is degraded with respect to the channels to both legitimate 
receivers, then the individual secrecy capacity region is given by the union of the non-negative rate pairs 
(i?i,i? 2 ) satisfying 

< min{/(X; Fi) - /(X; Z) + i? 2 , I{X; Fi)}; 

i ?2 < min{/(X; F 2 ) - /(X; Z) + i?i, I{X; F 2 )}, 

where the union is taken overp{x). 

Proof: Under the degradedness condition, we have that I{X\Z) < min{/(X; Fi),/(X; F 2 )} holds for 
any p{x). Utilizing the scheme in Proposition 5, Region I in Fig. 9 is achievable. To show Region II is 
achievable, one can employ secrecy coding [4, Theorem 3] to achieve rate pairs (i?i,i? 2 ) such that i?i = 0 
and i ?2 < I{X;Y 2 ) — I{X; Z). Then, applying time sharing with the left boundary rate pairs of Region I, 
one obtains the remaining rate pairs of Region II. A similar proof applies to establish the achievability of 
Region III. 

The converse follows from the fact that the achievable region is equal to the intersection of upper bounds 

given in [35, Theorem 1], which is the capacity region of the BC-RSI without an external eavesdropper, 

and the upper bound given in Proposition 21, which is a partial upper bound by applying the results for 
wiretap channel with shared key for one receiver (while ignoring the requirement of reliable and secure 


February 26, 2015 


DRAFT 
















17 


communication for the other). ■ 

As shown in Fig. 9, the individual secrecy capacity region for a weak eavesdropper is a rectangle with 
missing corners. Due to the symmetric roles of receiver 1 and receiver 2, the rate region is bounded in a 
symmetric manner as well. But, unlike the case of a strong eavesdropper, for which the individual secrecy 
capacity region is given in Fig. 5, asymmetric rate pairs are possible. Note that both receivers could benefit 
from each other due to the possession of the message of the other as side information. On one hand, higher 
rate for one receiver indicates more side information for the other. As a result, there is no loss in the high 
rate pair region (i.e., i?i, i ?2 > ^(Al; Z)), compared to [35, Theorem 1] which gives the capacity region of the 
BC-RSI without any secrecy constraints. That is, individual secrecy to each legitimate receiver is offered for 
free in high rate region. On the other hand, lower rate for one receiver implies less side information for the 
other. In this case, the side information might be insufficient to facilitate the secure communication of the 
other message at a high transmission rate and additional randomness might be necessary. This results in a 
loss in the rate region, i.e., the missing corners. Another interesting observation is that, for communication 
under individual secrecy constraint, one may not claim that if (i?i, R 2 ) is achievable, then (i?i — ci, i ?2 ~ C 2 ) 
is achievable for any Ci < i?i, C 2 < i? 2 - This follows as the individual secrecy rates are coupled in the BC-RSI 
setting. 


C. Superposition eoding 

It is well-known that superposition coding is optimal for a degraded broadcast channel where X ^ Yi ^ Y2 
forms a Markov chain, wherein one can transmit a cloud center to the weak receiver and both the cloud center 
and satellite codewords to the strong receiver [47]. For the BC-RSI model, we consider utilizing the one-time 
pad signal as the cloud center and additional information on both messages being carried in the satellite 
codeword. This approach generalizes the aforementioned secret key approach and the combined secret key and 
secrecy coding approach, and thus achieves the optimality for stronger and weaker eavesdropper scenarios. 
In the following, we first provide the corresponding achievability region and then discuss the details of the 
proposed scheme together with the special cases. 


Theorem 7. The individual secrecy rate region for the BC-RSI with an external eavesdropper is achievable 
for the set of the non-negative rate pairs (i?i,i? 2 ) such that 


<min{/(R;ri), /(R; FijC/) -/(R; Z|[/) + R 2 }; 

R 2 < min{/(R; Y2), /(R; R 2 IC/) - /(R; Z\U) + i?i}. 
over all p{u)p{v\u)p{x\v) subject to I{V;Yi\U) > I{V;Z\U) for i = 1, 2. 


(17) 


Proof: The proof is given in Appendix C. ■ 

The coding approach we develop here utilizes cloud centers, i.e., the D" codewords, to carry a one¬ 
time pad signal constructed from parts of the messages. In particular, the message intended for receiver i 


February 26, 2015 


DRAFT 



18 


is splitted into Mi = {Mik, Mi^k, Mis), and the one-time pad signal carried by u^{mk) is constructed as 
Mk = Mik © M 2 k- This cloud center is designed to be decodable at both receivers, which then extract their 
desired messages utilizing the corresponding side information available. In addition, the code design utilizes 
satellite codewords, i.e., the V'^ codewords, that are not only superimposed on the cloud centers but also 
carry additional information represented as {Mgk, Mis, M 2 s, Mr). Here, Msk is an additional one-time pad 
signal injected into H", and given by Msk = Misk © M 2 sk, and Mr is additional randomness. We remark 
that both Msk and Mr serve as randomness to confuse the eavesdropper in this scheme, in order to achieve 
secrecy of {Mis, M 2 s). 

An interesting aspect of our superposition coding approach lies in the role of one-time pad signals. On 
one hand, one-time pad signal is utilized as the message of the cloud centers (i.e., Mk). On the other hand, 
it is also utilized as a part of randomization within the satellite codewords (i.e., Msk). In other words, the 
coding scheme takes advantage of the rate splitting of one-time pad signals, in order to serve for these two 
distinct purposes. 

One may wonder, whether further rate splitting helps to improve the current region or not. For instance, 
split Mi into Mi = {Mik, Misk, Mis, Mim), with an additional layer in the coding scheme, say T" which 
carries information on Mim that is secured by employing secrecy coding. Interestingly, the answer is no 
if still using superposition coding. For a detailed proof of this, one can refer to Appendix D. However, 
if combining with Marton’s coding, further rate splitting may improve the achievable rate region as we 
demonstrate in Section V-D. 

Furthermore, we have the following observations: 

• Setting ©2 = 0, the region coincides with the secrecy capacity region of the wiretap channel [4]; 

• Letting [/ = 0 and Rk = Rsk = 0 in the proof as given in Appendix C and applying Fourier-Motzkin 
procedure, an achievable region under the joint secrecy constraint (follows from the secrecy proof in 
Appendix C) can be obtained. And this region (i.e., (23)) coincides with the one established in [36]. 

• Superposition coding remains optimal in the following cases. 

1 ) A strong eavesdropper, where the eavesdropper’s channel is less noisy than both of the legitimate 
receivers. In this case, the individual secrecy capacity as shown in Fig. 5, can be achieved by 
taking U = V = X, whereby the superposition coding reduces to the secret key approach. (See 
Theorem 4.) 

2) A weak eavesdropper, where both of the legitimate receivers channels are less noisy than the one 
to the eavesdropper. In this case, the individual secrecy capacity is as shown in Fig. 9. Here, the 
left boundary rate pairs of Region H in Fig. 9 can be achieved by taking R 2 = 0, whereby the 
superposition coding reduces to the secrecy coding approach as proposed in [3], [4]. Similarly, the 
bottom boundary rate pairs of Region HI in Fig. 9 can be achieved by taking Ri = 0. Region I 
in Fig. 9 can be achieved by taking [/ = 0 and V = X, whereby the superposition coding reduces 
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to the combined secret key and secrecy coding as given in Section V-B. These achievable points 
together with their time sharing provide the individual secrecy capacity region as shown in Fig. 9. 
3) If the eavesdropper’s channel is deterministic in the manner that Z is a function of X, superposition 
coding is optimal for achieving individual secrecy capacity as we demonstrate in the Theorem 8. 


Theorem 8. For the BC-RSI channel with an external eavesdropper, if the eavesdropper’s channel is 
deterministic in the manner that Z is a function of X, then the individual secrecy capacity region is given by 
the convex hull of the non-negative rate pairs satisfying 


i?i <min{/(X;Yi), I{X-,Y,\Z) + R 2 }, 
R 2 <mm{I{X;Y 2 ), I{X;Y 2 \Z) + Ri}. 


(18) 


Proof: The achievability is obtained by taking U = Z and V = X in (17). The proof of the converse is 
given in Appendix E. ■ 

In particular, if Yi, Y 2 and Z are all functions of X, the above corollary simplifies to the following: 


Corollary 9. If the BC-RSI channel with an external eavesdropper is deterministic in the manner that Z, 
Yi, andY 2 are deterministic functions of X, then the individual secrecy capacity region is given by the convex 
hull of the non-negative rate pairs (i?i,i? 2 ) satisfying 


Ri < mm{H{Yi), H{Yi\Z) + R 2 }, 
i?2 < mm{H{Y2), H{Y2\Z) + i?i}. 


(19) 


Remark 10. Note that the deterministic BC is a more general model than the linear deterministic BC model 
discussed in Section IV. As a direct consequence, Theorem 2 can be regarded as a special case of Corollary 9. 


The region given in Theorem 7 fails to achieve any positive rates if the condition I{V;Yi\U) > I{V;Z\U) 
is not satisfied for either i = 1 or i = 2. For instance, when I(V;Yi\U) > I{V]Z\U) > I{V;Y 2 \U) for 
a given input probability distribution, the requirement of decoding randomness (in Y" codewords) at the 
second receiver becomes excessive. To resolve this problem, we develop a Marton’s coding approach in the 
following section, where we further introduce two individual satellite codewords and require Vf' 

to be decoded only at receiver i. This allows us to get a larger rate region for the mixed scenarios where the 
eavesdropper is stronger than one legitimate receiver but weaker than the other one. 


D. Marton’s coding 

Although superposition coding demonstrates its optimality for some broadcast channels wherein one 
receiver is stronger than the other, it is not optimal in general. In fact, for broadcast channels, Marton’s 
coding can outperform superposition coding by not requiring either receiver to recover both messages 
(for broadcast channels without any secrecy constraints) [47]. In the following, we consider achieving the 
indivudual secrey of the BC-RSI model, by utilizing the one-time pad signal as the cloud center, further 
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information on both messages being carried in the satellite codewords, and additional information on each 
messages being conveyed in individual satellite codewords. This coding scheme is built on the previous 
superposition coding scheme but with one more layer that employs Marton’s coding. As a direct result, it 
generalizes the rate region established by superpostion coding. Moreover, we provide a special case under 
which this Marton’s coding approach outperforms the aforementioned superposition approach (the region 
given in Theorem 7). 


Theorem 11. The individual secrecy rate region for the BC-RSI with an external eavesdropper is achievable 
for the set of the non-negative rate pairs (i?i,i? 2 ) such that 


( 20 ) 


Ri </(foo,^i;n|C/)-/('K),^i;^|C/) + min{i?2, I{U-,Y^)+I{V^-Z\U)y, 
i?2 </(foo, 1^2; YyU) - I{Vo, foz; Z\U) + min{i?i, /(t/; Y2) + /(foo; Z\U)}, 
over anyp{u,Vo,Vi,V2,x) = p{u)p{vo\u)p{vi,V2\vo)pix\vi,V2) subject to I{Vi;V2\Vo) < I{Vi; Z\Vo)-\-I{V2; Z\Vo)- 
/(foi, 1/2; Z\Vo), IiV,;Y,\Vo) > I{Vp,Z\Vo) and Y,\U) > I{Vo, 14 ; Z\U) for i=l,2. 


Proof: The proof is given in Appendix F. ■ 

The coding approach we develop here is built on the superposition coding which is discussed in Section 
V-C, but with one additional coding layer that employs Marton’s coding. That is, we split Mi into Mi = 
{Mik, Misk, Miss, Mism), for z = 1, 2, where Mik, Misk,Miss are encoded into [/", Vff codewords in the same 
way as by the superposition coding; while information on Mism, M 2 sm are carried by individual satellite 
codewords respectively, via Marton’s coding. Note that the secrecy of Mism, M 2 sm is ensured by 

additional randomness with the spirit of secrecy coding approach [3], [4]. 

As reflected in the obtained region in (20), for legitimate receiver z, part of the message, i.e., {Mik,Misk), 
is secured via one-time pad; while the other part, i.e., {Miss, M^m), is secured via secrecy coding. More 
specifically, for receiver 1, on one hand, {Mik, Misk) is secured via one-time pad (with key rate R 2 ) in 
the underneath superposition coding structure (at most I{U;Yi) bits in the cloud center C/" and at most 
I{Vo;Z\U) bits as randomness in the satellite codeword fog"). Thus, in total at most min{i? 2 , I{U-,Yi) -\- 
/(Vb;2'|[/)} bits can be secured via one-time pad. On the other hand. Miss, Mism are secured via secrecy 
coding in fog" and fo", respectively, which in total contribute I{Vq, Vi,Yi\U) — I{Vq, 14; Z\U) secret bits. 

Furthermore, we have the following observations: 

• Letting [7 = 0 and Rk = Rsk = 0 in the proof as given in Appendix F and applying Fourier-Motzkin 
procedure, an achievable region under the joint secrecy constraint (follows from the secrecy proof in 
Appendix F) can be obtained. And this region (i.e., (24)) improves the one given in (23) which coincides 
with the one established in [36]. 

• If we set foi = 14 = fo), it reduces to the superposition coding approach and achieves the rate region in 
(17) as given in Theorem 7. 

• For the case where the eavesdropper’s channel is less noisy than one legitimate receiver, but more noisy 
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than the other, (e.g.: Z is less noisy than Y 2 , Z) > I{U ; Y 2 ) for Sk\\p{u) such that U ^ X ^ {Y 2 , Z) 

[47]), Marten’s coding approach gives an achievable rate region by setting U = Vq = V 2 in (20) as 
provided below. 


Corollary 12. For the BC-RSI with an external eavesdropper, if Z is less noisy than Y 2 , then an achievable 
individual secrecy rate region is given by the union of non-negative rate pairs (i?i,i? 2 ) satisfying 

i?i </(Cl; Yi I [/) -/(Cl; ZIC) + i?2; 


( 21 ) 


i ?2 <min{/(C/;C 2 ),/?i}, 

where the union is taken over p{u)p{vi\u)p{x\vi,u). 


We recall that superposition coding is optimal in cases of either a strong or weak eavesdropper (compared 
to both legitimate receivers). However, in the mixed case, where the eavesdropper’s channel is less noisy than 
one legitimate receiver, but more noisy than the other, superposition coding is no longer optimal. 

For instance, consider the case where Z is strictly less noisy than Y 2 , i.e., I{V] Z) > /(H; C 2 ) for any p{v) 
s.t. C —>■ X —>■ (F 2 , Z). In order to apply superposition coding, one has to set C = 17 to satisfy the condition 
that I{V]Y 2 \U) > /(C;Z|[/) given in (17) in Theorem 7. Therefore, the region in (17) reduces to the set of 
the non-negative rate pairs (/?i,i? 2 ) such that 


Ri < /? 2 ; 


( 22 ) 


R 2 < min{/(C/;C 2 ),/?i}. 

Compare the obtained region in (22) by superposition coding with the one in (21) by Marlon’s coding. 
It is easy to see that the Marlon’s coding outperforms in this case by not requiring the decoding of the 
corresponding individual satellite codeword at the weak receiver. 


E. Joint secrecy rate region for BC-RSI with an external eavesdropper 

As a by-product, achievable joint secrecy rate regions can be obtained by letting U = % and Rk = Rsk = 0 
in the superposition coding approach and Marlon’s coding approach proposed in previous subsections, which 
validity follows from the secrecy proof in Appendix C for superposition coding; and the secrecy proof in 
Appendix F for Marlon’s coding, respectively. Note that the achievable joint secrecy rate region by Marlon’s 
coding, i.e., (24), is derived with the addition of a time-sharing random variable Q. 


Corollary 13. (Achievable joint secrecy rate region by superposition coding) For BC-RSI with an external 
eavesdropper, an achievable region under the joint secrecy constraint can be obtained by superposition coding 
as the set of the non-negative rate pairs (Ri, R 2 ) such that 


Ri<I{V-,Yi)-I{V-,Z) 

R2<I{V;Y2)-IiV;Z) 

where H —>■ X —>■ (Yi, Y 2 , Z) forms a Markov chain such that I(V; Yi) > I{V; Z) holds for i = 1,2. 


(23) 
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Fig. 10: Gaussian BC-RSI with an external eavesdropper. 


Corollary 14. (Achievable joint secrecy rate region by Marion’s coding) For BC-RSI with an external 
eavesdropper, an achievable region under the joint secrecy constraint can be obtained by Marion’s coding 
as the set of the non-negative rate pairs (i?i, R 2 ) such that 

Ri<IiVo,Vi;Yi\Q)-IiVo,Vi;Z\Q) 

R2<I{Vo,V2;Y2\Q)-I{Vo,V2;Z\Q) (24) 

Ri+R2< HVo, Vi; Fi \Q) + /(Vq, V 2 ; F 2 IQ) - 2/(Vo; Z\Q) - I{V^- V 2 IVo, Q) 

over any p{q, vo,vi,V 2 ,x) = p{q)p{vo\q)p{vi,V 2 \vo)p{x\vi,V 2 ) subject to /(Vi, V 2 ; Z|Vo) < /(Vi;Z|Vo) + 
/(V 2 ;F|Vo) -/(Vi; V 2 IV 0 ) and I{Vp, Z\Vo) < /(V,;V|Vo) for i = 1,2. 

Remark 15. The region by superposition coding given in (23) coincides with the one established in [36]. 
Note that (23) is included in (24), i.e., the region by Marion’s coding, as a special case of (24) by taking 
Vi = V 2 = Vo. 


VI. Gaussian BC-RSI 

In this section, we consider Gaussian broadcast channel with receiver side information (Gaussian BC- 
RSI) as shown in Fig. 10. It is known that one can apply the discretization procedure [47] to extend the 
coding schemes for finite alphabet channels to their Gaussian counterpart. Using this technique, we obtain an 
achievable individual secrecy rate region for the Gaussian BC-RSI. Furthermore, we derive an outer bound 
to the secrecy capacity region, and, show that, in the high SNR regime, one can approach the individual 
secrecy capacity region for the Gaussian BC-RSI by employing the superposition coding. This observation 
is consistent with the results suggested by the linear deterministic approach analyzed in Section IV. 

Suppose X is the channel input with a power constraint P on it and the signals received by both receivers 
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and the eavesdropper are 

Yx=X + Nx- 
Y2=X + N2-, 

Z = X + Ne, 

where Ni ~ A/’(0, crj), N 2 ~ A/’(0, (t|) and Ne ~ A/’(0, (Xg) are additive white Gaussian noise (AWGN) 
independent of X. According to the noise level in the channels to both receives and the eavesdropper, the 
overall channel can be regarded to be stochastically degraded in different orders. For simplicity, we only 
consider their corresponding physically degraded instances. The reason is that the same analysis can be 
easily extended to the stochastically degraded cases. So the following scenarios are of our interest (without 
loss of generality we assume cti < < 72 ): 

1 ) CTe > a 2 > cr^, i.e., X —>■ Yi —>■ >2 Z forms a Markov chain, 

2) (72 > cri > a^, i.e., X —>■ Z —>■ Yi —>■ ^2 forms a Markov chain, and 

3) cr| > Ug > CTi, i.e., X —>■ Yi —>■ Z —>■ y 2 forms a Markov chain. 

The individual secrecy capacity of the first two cases can be easily derived by extending the results for 

discrete memoryless channel model to the Gaussian scenario. For the third case, we show in the following 
that we can approach the individual secrecy capacity region as P ^ or P a^. 


A. An outer bound 


Proposition 16. An outer bound of the individual secrecy capacity region for the Gaussian BC-RSI when 
X —>■ Yi —>■ Z —>■ I 2 forms a Markov chain is given by the set of the rate pairs (i?i, R 2 ) satisfying 


i ?2 <C 


f (l-7«)-P \ 

jaP + cr| y 


^ cxP 

i ?2 ^ ^ 


-C 


aP 


i?2, 


for some 0,7 G [0,1], and C{x) = ^ log(l + x) is the Gaussian capacity function. 


Proof: We observe that 

^log27rea2 =/r(Y”|X”) =/i(Y”|Mi,M2,X") 

< h{Z^\Mi,M2) < h{Z^\M2) < h{Z^) 

< -log27re(P + cr2), 

where (a) is due to the fact that for a random variable with a fixed variance, Gaussian distribution maximizes 
the entropy. This shows that there exist a,j € [0,1], such that 


/i(Y”|M2) 

Tl 

= 2 log27re(aP + cr2); 

(25) 

/i(Z"|Mi,M2) 

= ^ log 2'KeipfaP + (Tg). 

(26) 
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In particular, we have 

(b) 

/i(Z”|Mi) = > h{Z^)-ne > h{Z'^\M 2 ) - ne = - log27re(aP + a^) - ne, (27) 

where (5) is due to the individual secrecy constraint. 

Similarly, we have 

|log27rea| = h{Y^\X^) = h{Y^\M^, X^) 

< h{Y^\M^,M2) < h{Y^\M^) < H{Y^) 

(d) 

< -log27re(P + cr 2 ). 

There must exist a /3 such that 

/r(r 2 ”|Mi, M 2 ) = I log2^e(/3P + al). (28) 

Therefore, 

nP2 = H{M2) = H{M2\Mi) = I{M2] ITI^i) + nO{e) 


= h{Y^\Mi) - h{Y^\Mi,M 2 ) + nO{e) 
(5) n P + cr| 


(29) 


where (c) is due to the Fano’s inequality and (d) is due to (28). 

Recall the Markov chain {Mi, M 2 ) X^ T" ^ 2 "- ^PPlying the entropy power inequality 

(EPI) [47], we obtain 


71 

hiY^^\Mi,M2)>-\og 


2ih{z'^‘\M^,M2) +27re(cr| 



Using (28) here, we obtain 

h(Z”|Mi,M2) < |log2^e(/3P + (T 2 ). 

Comparing to (26) which gives that h{Z'^\Mi, M 2 ) = f log27re(7Q;P + Cg), we have 


70 < /3. 


(30) 


Recall (29), we have 


n , P + (^2 ^ n ^ P + 


nR 2 < ^ log + nO{e) < (- log + ^^(e) = nC ( 


2 ° pP + ai 

Letting e ^ 0, we obtain 


2 'jaP + a2 


V jaP + ai J 


\ jaP Pal) 


nO{e). 


(31) 


Now we proceed to bound Pi. First we show Pi > P 2 as follows. 

nPi = H{Mi) = H{Mi\M2) 

> I{Mi;Yi^\M2) 
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= I{Mi;Y{^,Z^\M2) - /(Mi; Z"|M2, Y^) 

= /(Mi;Z"|M 2 ) +/(Mi;yi"|M 2 ,Z”) 

= /i(Z”|M2) - M 2 ) + /(Mi; ri"|M2, Z") 

> /i(Z”|M2)-/i(Z”|Mi,M2) 
if) 

> /i(Z”) - /i(Z”|Mi, M2) - nCl(e) 

> /i(Z”|Mi) - /i(Z”|Mi, M2) - nCl(e) 

= /(M 2 ;Z”|Mi)-nO(e) 

(3) 

> /(M 2 ; r 2 ”|Mi) -nO(e) 

= i/(M2|Mi) - i/(M2|Mi,y2") - nO(e) 

(ft) 

> ni ?2 — nO(e), 

where (e) follows by the fact that /(Mi; Z"|M 2 , 17 *) = 0, which is implied by I(Mi, M 2 ; = 0 due 

to the channel degradedness, i.e., the Markov chain {Mi, M 2 ) —t X" —>• F” ^ Z” —>■ Y 2 ; (/) is due to the 
individual secrecy constraint; and {g) is due to the channel degradedness, i.e., [Mi, M 2 ) —t —>• F” —>• 
Z" —>• F 2 "; {h) is due to the Fano’s inequality. 

Finally, letting e ^ 0, we obtain 

i?i > R 2 . (32) 

On the other hand, we have 


nRi = //(Ml) = //(M1IM2) 

< /(Mi; Fi"|M 2) +nO(e) 

= /(Mi;Fi”,Z”|M 2) - /(Mi; Z”|M2,Fi”) + nO{e) 

/(Mi; Z"|M2) + /(Mi; Fj"|M 2, Z") + nO(e) 

= /i(Z"|M 2) - /i(Z"|Mi, M2) + /(Mi; F”|M2, Z”) + nO(e), ( 33 ) 

where (i) is due to the Fano’s inequality and (j) is due to the channel degradedness. Note that 
/(Mi; F”|M 2 , Z”) = /i(Fi”|M 2 , Z”) - /r(F”|Mi, M2, Z”) 

< /i(Fi”|M 2 , Z”) - /i(Fi”|Mi, M2, X", Z”) 

= /i(Fi”|M 2 , Z”) - /i(Fi”|Z:”, Z”) 

= /i(Fi”, Z”|M 2 ) - /i(Z”|M 2 ) - /i(Fi”|Z:”, Z”) 

= /i(Fi”|M 2) + /i(Z”|Fi”) - /i(Z”|M 2) - /i(Fi”, Z”|X”) + /i(z”|z:”) 

= /i(F”|M 2 ) + /i(Z”|F”) - /i(Z”|M 2 ) - /i(F”|Z:”) - /i(Z”|F”) + /i(z”|z:”) 
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= h{Y{^\M2) - h{Z^\M2) - h{Y{^\X^) + /i(Z”|X"), (34) 

where (k) follows by the fact that h{Z^\M 2 ,Y{^) = h{Z^\Y{^) and h{Z^\X^,Y{^) = h{Z^\Y{^) due to the 
Markov chain {Mi, M 2 ) X” Yi” ^ Z”. 

Recall the Markov chain (Mi, M 2 ) —?■ X^ Y^ —>■ Z" —>■ Y^- We apply the EPI and obtain 

/i(Y”|M 2 ) > I log + 27re(cr2 - al) . 

In addition to (25) which gives that h(Y"|M 2 ) = § log27re(aP + a^), we have 

/i(Ei”|M 2 ) < |log27re(aP + CT?). (35) 

Combining (33) and (34), we have 


ni?i < /i(Y”|M 2 ) - /i(Z”|Mi, M 2 ) + /(Mi; r”|M 2 , Y”) 

< h{Y^\M2) - /i(Z”|Mi, M 2 ) - /r(r”|X”) + /i(Z”|X”) 

= /r(Z”|Mi) - /i(Y”|Mi, M 2 ) + /i(Yi”|M2) - h{Z'^\Mi) - h{Y^\X'^) + /i(Y”|Y") 
= /(M 2 ; Z”|Mi) + h{Y^\M2) - h{Z'^\Mi) - h(Yi”|X") + /i(Y”|Y”) 

< n/?2 + /i(Yr|M2) - /i(Y"|Mi) - h(Yi"|/s:") + /i(Z"|Y") 


= ni?2 + /i(Yi”|M 2) - /i(Z"|Mi) - /i(iV”) + h(7V,") 

„ n, {aP + a1)ul , 

< n /^2 + ^log / p, 2 ^ 2 +nO{e) 

2 (ai^ + ajjcrj 


= ni?2 + fiC 


nO{e), 


where (1) is due to the fact that /(M 2 ; Y”|Mi) < H{M 2 ) = ni? 2 ; and (m) is due to (27) and (35). 
Finally, letting e —>■ 0, we have 

Ri ^ C ( —5- I — ( —— I + /?2. 


Combining (31), (32), and (36) establishes the outer bound. 



Remark 17. Interestingly, 7 = 1 corresponds to the joint secrecy constraint, since 7 = 1 implies that 
/i(Z”|Mi, M2) = h{Z^) according to ( 26 ). However, in case of {Mi, M2) —>■ Y" —>■ Y” —>■ Yff, we have 

nR 2 = H{M 2 ) = I{M 2 -,Y^\Mi) < I{Mi,M 2 ;Yf^) < /(Mi,M2;Y2”, Y") = /(Mi,M2; Y") = 0 

under joint secrecy constraint. That is, only positive Ri is possible. And, Ri < C {Pjof ) - C (P/a2) 
obtained by taking a = 1 via Wyner’s secrecy coding. 
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B. An inner bound 


Proposition 18 . An inner bound of the individual secrecy capacity region for the Gaussian BC-RSI when 
X ^ Yi ^ Z ^ Y2 forms a Markov chain is given by the set of the rate pairs (i?i, R2) satisfying 




where a, 7 G [0,1]. 


Proof: For a fixed pair a, 7 G [0,1], one can derive an inner bound of (i?i, R2) by applying superposition 
coding as described in the following. 

Codebook generation: Randomly and independently generate 2"^^ sequences u^{k), fc G [1 : 2"^^], each 
i.i.d. A/’(0, (1 — ja)P); and sequences u”(s,r), (s,r) G [1 : x [1 : 2"^'’], each i.i.d. 

A/'(0,7aP). 

Encoding: To send the message pair (mi, m2) with mi = {mik,rnis), where mik is of the same length as 
m 2 , the encoder encapsulates mik and m 2 in mu with m^ = mik 0 m 2 , randomly chooses r G [1 : 2"^’'], 
and transmits x^(mi,m2) =u^{mk) 0 u"(mis,r). 

Decoding: Receiver 2 decodes m^ from ytf = u^{mk) + (v"(mis, r) ) while treating u"(mis, r) as noise, 
and further recovers m 2 with his knowledge of mi. The probability of decoding error tends to zero as n —>■ 00 

ifi? 2 <C(ii^). 

Receiver 1 uses successive cancellation. It first decodes m^ from y” = M"(mfe) 0 (v"(mis,r) + nf) while 
treating u"(mis,r) as noise, and recovers part of mi, i.e., mik, with the knowledge of m 2 . The probability 
of this decoding error tends to zero as n —>■ 00 if i ?2 < C' ^ ^ , since it implies that R2 < C ^ ^ 

due to the fact that af < cr^- (This implies that R 2 < Ri-) Then, it subtracts off u‘^{mk) and decodes 
u"'(mis, r) + nf to recover (mis, r) and thus mis, be., the rest of mi. The probability of this decoding error 
tends to zero as n —)■ 00 if i?i — i ?2 0 Pr < C* • 

Secrecy: The eavesdropper could decode mk from z" = u'^{mk) + (u"(mis,r)Tn”). However, m^ does not 
disclose any information about mis and m 2 , individually. Subtracting off u‘^(mk) from z", the eavesdropper 
gets a better observation u"(mis,r) 0 n", which actually does not help to recover mis ii Rr ^ C 
In other words, the secrecy of mis is guaranteed by the embedded secrecy coding in the choice of u”. The 
individual secrecy for mi then follows from an analysis similar to the previous sections. 

As a conclusion, {Ri,R2) is achievable under the individual secrecy constraints, once Ri,R2,Rr satisfy 

„,<c(<i^); 

V yaP 0 cr| y 


Pi — P 2 0 Pr 0 C 


Rr 


c 


'yaP 


(^) 
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Eliminating Rr, we get the desired region of (i?i, R 2 ), which concludes our proof of achievability. ■ 


C. Individual secrecy capacity region 

Proposition 19 . When (t| > Cg > ctJ, and P ^ or P af, the individual secrecy capacity region for 
the Gaussian BC-RSI is given as the set of {Ri, R 2 ) satisfying 




i?2, 


where 7, a S [0,1]. 


Proof: Consider the gap between the inner and outer bounds derived in previous subsections. If we take 
the same choice of 0,7 in both bounds, the gap occurs only in i?i, which is given by 
'aP\ ^ (aP\ ^ f ^aP'' 


C 


-C 


-C 


C ^ 2 ^^ ^ 1 log (aP + cr?)( 7 aP + cr 2 ) 


0 , 


J V erf y \ <^e J 2"^° {aP + a'^){jaP + af) 

as P S> (Jg or P <C CTi, regardless of the values of 0 , 7 . ■ 

As a conclusion, we characterize the individual secrecy capacity region for the Gaussian BC-RSI as follows. 


Proposition 20 . The individual secrecy capacity region for the Gaussian BG-RSI is given by the following 
set of (Pi, R2): 


If cr^ > cr| > cr? : 


Pi < min S C 


P 2 < min < C 


P 


P 


-C 

-C 


P 2 , C 

Pi, c 


p 


p 


If cr| > cr? > cr] 


2 . 


Pi = P2 < c 


p 


If (J 2 > cr^ > erf, and, P ':S> erf or P af : 


7 P 


7 P 


Pi <G -C +P2; 


P2 <c 


(1-7)P 


7 P + 

VII. Conclusion 


, where 7 G [ 0 , 1 ]. 


In this paper, we studied the problem of secure communication over BC-RSI under the individual secrecy 
constraints. We first characterized the individual secrecy capacity region for the linear deterministic channel 
model. Then, utilizing secret key, secrecy coding, superposition coding, and Marton’s coding approaches, 
we derived achievable rate regions for the discrete memoryless model. Together with converse arguments, 
these techniques allow us to characterize the individual secrecy capacity region for some specific scenarios 
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which include 1) the case of a strong eavesdropper (as a line on plane); 2) the case of a weak 

eavesdropper (as a rectangle with missing corners); and 3) the case that the eavesdropper’s channel is 
deterministic. Our results exhibit the coupling between the communication rates. In particular, we observe 
that one can not arbitrarily decrease one user’s rate without sacrihcing the rate of the other. Moreover, we 
studied the corresponding Gaussian scenario, where, in addition to the capacity regions for strong and weak 
eavesdropper cases, we established the individual secrecy capacity region for the low and high SNR regimes 
when the eavesdropper channel is weaker than one of the legitimate receivers but stronger than the other. 

We here point out some avenues for further research. First, the characterization of the individual secrecy 
capacity region for the general case remains as an open problem. In particular, the characterization of the 
capacity region for the mixed case (where the eavesdropper channel is less noisy than one legitmate receiver 
but more noisy than the other) has resisted our best efforts thus far. (For the Gaussian case, we were able to 
establish low and high SNR individual secrecy capacity results in this scenario.) Remarkably, this mixed case 
is distinctive for the study on secure communication via broadcast channels (with RSI or without RSI) since 
in this case, positive rate pairs are attainable under the individual secrecy constraint but impossible under 
the joint secrecy constraint. We believe that our results will initiate the study of individual secrecy for other 
multi-terminal models. During the preparation of this manuscript, we have noticed that the parallel work 
[40] has considered the extension of BG-RSI model to include common messages. Studying other channel 
models under the lens of individual secrecy and comparing this notion to other secrecy constraints will be 
of interest. 


Appendix A 

Upper bound on the individual secrecy rate 

An upper bound on the individual secrecy rate follows from the results for wiretap channel with shared 
key [24] as provided below. 

Lemma 21. For any R 2 in the achievable region, Ri is upper bounded as 

Ri< max mm{I(y-,Yi\U) - I(y;Z\U) + R2,I(y;Yi)}. 

U^V^X^{Yi,Z) 

If the channel to the legitimate receiver 1 is degraded with respect to the channel to the eavesdropper, then 
for any R 2 in the achievable region, Ri is upper bounded by 

Ri < ^ m^ 5 ^^min{/(A; Yi) - J(A; Z) + R2, 1 iX;Yi)}. 

Similar results hold for interchanging 1 and 2 above. 

Proof: The proof follows by the result given for the wiretap channel with shared key [24, Theorem 1]. 
As the rate for M 2 is R 2 , then the secrecy rate for receiver 1 can be upper bounded by the wiretap channel 
with shared key of rate i? 2 - ■ 
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Appendix B 

Achievability Proof for Theorem 2 

For each scenario, a specific coding scheme is provided, where for a given mi = [mi(l), • 
7712 = [™2(1)) • • • , ”^ 2 (^ 2 )]i we construct the codeword X = [a;(l), x(2), • • • , x{ni)]'^. 


, 77ii(i?i)] and 


A. q = m > n2 > rie 

1) i?i < i ?2 and Ri < Ue ■' We have 

Rl < Ue] Rl < R2 < n 2 — Ue + Rl- 

We set 


(37) 


’:{k) = < 


mi(fc) © m 2 {k) 
r{k) 

m2(k — Tie + i?i) 

r{k) 


l<k<Ri 

Rl < k < Ue 

Ue < k < Ue + R2 — Rl 

Ue + R 2 — Rl < k < ni 


where r(fc) is randomly chosen from {0,1}. The construction of X is illustrated in Fig. 11. In this scenario, 
receiver 2 could recover m2 completely only if R2 — Ri + Ue < n2. Combining this with the aforementioned 
conditions, i?i < R 2 and Ri < Ue, we obtain the desired region of (i?i,i? 2 ) as specified in (37). 


mi : 

m 2 : 

: 


mi(l), • • • ,77ii(i?i) 


7712 ( 1 ), • • • ,7772(i?l), 

■ ■ ,TO2(7?2) 

Rl 

/-^ 

R2—R1 

/--V 

mi(k) © ?772(fc) 

r(fc) 7772(fc — 77e + i?l) r{k) 

Tie 



<n2 


Fig. 11: Codeword X for ni > n 2 > and Ri < i?2,7?i < Ue- 


2) Rl < i ?2 and Uf. < Ri: We have 


Ue < Rl < R2 < n 2 - 


(38) 


We set 


{ TOi(fc) © m2{k) 1 < A: < i?i 

7772 (fc) Rl < k < R 2 

r{k) i ?2 < fc < 77i, 


where r(fc) is randomly chosen from {0,1}. The construction of X is illustrated in Fig. 12. In this scenario, 
receiver 2 could recover m 2 completely only if R 2 < 772- Combining this with the aforementioned conditions, 
Ue < Rl < R2, we obtain the desired region of (i?i,i? 2 ) as specified in (38). 
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mi : 
m 2 : 

: 


mi(l), • • • ,mi(iii) 

m2(l),--- ,m2(i?i),-" ,W2(i?2) 


Ri 


R 2 —R 1 


mi(/c)©m2(^H m2(fc) r(fc) 


<n2 


Fig. 12 : Codeword X for ni>n2> Ue and Ue < Ri < i?2- 


3 ) Ri > i?2 and R2 < Ug: We have 

R2 < Ue', R2 < Rl < ni — Ue + R 2 - 

We set 


( 39 ) 


x{k) = < 


mi(fc) © m 2 (/c) 1 < A: < i ?2 

r(fc) R2 < k < He 

mi {k — Ue + R2) Ue + ^ < k < Ug Rl — R2 

r{k) ng Rl — R2 < k < Til 

where r{k) is randomly chosen from {0,1}. The construction of X is illustrated in Fig. 13. In this scenario, 
receiver 1 could recover mi completely only if Ri — R 2 + Ug < ni. Combining this with the aforementioned 
conditions, i.e., Ri > R 2 and R 2 < n 2 , we obtain the desired region of (i?i,i? 2 ) as specified in (39). 


mi : 

m 2 : 

: 


mi(l),--- ,mi(i?2),--- ,mi(i?i) 
m2(l), • • • ,m2(i?2) 


R 2 


Rl —R2 


mi(fc) © m2(k) 

r{k) mi{k — Ug + R2) r{k) 

Tie <712 



Fig. 13 : Codeword X for ni > 712 > Ug and Ri > R2,R2 < Re- 

4 ) Rl ^ R2 and Ug < i?2- We have 


We set 


R2 ^n 2 \ Ug < R2 < Rl < ni- 

mi(fc) © m2(fc) 1 < k < R2 
x{k) = 4 ^ mi(fc) R2 < k < Rl 

r{k) Rl < k < rii, 


( 40 ) 
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where r(fc) is randomly chosen from {0,1}. The construction of X is illustrated in Fig. 14. In this scenario, 
receiver 2 could recover m 2 completely only if R 2 <n 2 ] and receiver 1 could recover mi completely only if 
i?i <ni. Combining this with the aforementioned assumptions, rie < R2 < Ri, we obtain the desired region 
of (i?i,i? 2 ) as specified in (40). 


mi : 


m 2 : 




mi(l),--- ,mi(i? 2 ),'-' ,mi(i?i) 
m2(l), • • • ,m2(i?2) 




mi(fc) © m 2 {k 


Rl —i ?2 

mi(fc) r(fc) 


<n 2 

ni 


Fig. 14: Codeword X for ni>n2> Ue and ne < R2 < Ri- 


B. q = ni > He > n2 

Since R 2 < n 2 < Ue, we have 

We set 

x{k) = < 


i?2 < ^ 2 ; R2 < Rl < Til — He + R 2 - 


(41) 


mi(fc) © m 2 {k) 
r{k) 

mi(k — Tie + R2) 

r{k) 


l<k < R 2 
R2 < k < Tie 

Tie < k < Tie + Rl — R2 
Tie + Rl — R2 < k < TLi 


where r{k) is randomly chosen from {0,1}. The construction of X is illustrated in Fig. 15. In this case, 
receiver 2 could recover m 2 completely only if R 2 < ri 2 ', and receiver 1 could recover mi completely only if 
Rl — R2 + Tie < Til . Combining these with the fact Ri — R2 > 0, which is implied by the code construction, 
we obtain the desired region of (i?i,i? 2 ) as specified in (41). 


mi : 

m 2 ■ 


X^ : 


mi(l), • • • , mi(i? 2 ), • 

■ ■ ,mi{Ri) 

m2(l), • • • ,m2(i?2) 

R2 

Rl —R 2 

/-. 

miik) © m 2 {k) 

r{k) mi(fc —ne + i? 2 ) r{k) 

<712 


Tie ^712 



Til 


Fig. 15: Codeword X for ni > rie > n 2 - 
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C. q = rie > ni > n 2 

In this case, we have i?i < i ?2 and i ?2 < Ri both holds. This gives that 

Ri = R 2 = R < min{ni,n2}. (42) 


We set 


x{k) 


mi{k) © m 2 {k) 1 < fc < i? 

r{k) R < k < He, 


where r{k) is randomly chosen from {0,1}. The construction of X is illustrated in Fig. 16. In this scenario, 
both receivers could recover mi, m 2 , respectively, only if i? < min{ni,n 2 }. Combining this with the fact 
i?i = i ?2 = R, which is implied by the code construction, we obtain the desired region of (i?i, i? 2 ) as specified 
in (42). 


mi : 


m 2 : 


: 



r{k) 


R 



<min{ni ,712 } 


Tie 


Fig. 16: Codeword X for Ue > rii > n 2 - 


Remark 22. Note that in our achievability schemes, the elements of the input vector X are i.i.d. Bern{^) 
in all scenarios. That is, Bern{^) serves as an optimal input distribution to achieve the individual secrecy 
capacity. Nevertheless, this choice is not the only optimal one. As an alternative, instead of choosing as 
uniformly random, one can simply use zeros for the bits represented by r[k) in our achievability schemes. 


Appendix C 
Proof of Theorem 7 

Rate splitting: As illustrated in Fig. 17, we split Mi = (Mi^, Misj,, Mi^) and M 2 = {M 2 k, M 2 skT M 2 s), 
with both Mik and M 2 k of entropy nRk, both Mi^k and M 2 sk of entropy nRsk, Mis of entropy nRu and 
M 2 s of entropy ni? 2 s- Thus, we have Ri = Rk + Rsk + Ris and R 2 = Rk + Rsk + R 2 s- 


mi : 

m 2 : 



nRk 


nRg k 


nRis 


nRk 


nRs k 


nR2a 


Fig. 17: Superposition coding: Rate splitting. 
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Codebook generation: Fix p{u),p{v\u). First, randomly generate 2"^'= i.i.d. sequences u"{k), k G [1 : 
2"^'=], according to p{u). Secondly, for each u^{k), according to p{v\u), randomly generate i.i.d. sequences 
v^{k,msk,mis,m 2 s,r) with ruis, TO 2 s, 0 G [1 : x [1 : 2"-^i'>] x [1 : 2"-^='’] x [1 : 2^^’-]. 

Encoding: To send messages (mi, m 2 ), choose u^{k), where k = m^ = mit (Bm 2 k- Given u^(k), randomly 
choose r G [1 : 2"'^''] and find v'^(k,msk,rnis,m 2 s,r), where msk — wisfe © 'ni 2 sk- The choice of u^,v'^ for 
given (mi,m 2 ) is illustrated in Fig. 18. Generate x" according to p(x\v), and transmit it to the channel. 




v‘^(k,msk,'mis,m2s,r) : 


nRk 


mik © m2k 





D'Rsk 

nRr 


mis 

© 'R^2sk 

r 

m2s 


nRia 


nR2a 


Fig. 18: Superposition coding: Encoding. 


Decoding: Receiver 1 , upon receiving y" and with knowledge of m2, decodes rhi = (m2k © k,m2sk © 
Wsfe, TOis) if (k, msk,rhis,m2s) is the unique quadruple such that (u^(k), v^(k, rhsk, rhis,m2s, f), y”) is jointly 
typical. 

Receiver 2 , upon receiving and with knowledge of mi, decodes m2 = (mik © k,misk © frisk,fn2s), if 
(k,msk,rnis,m 2 s) is the unique quadruple such that (it"(fc), rhsfc, mis, m.2s, r), yj) is jointly typical. 

Analysis of the error probability of decoding: Assume that (Mi, M2) = (mi,m2) with mi = (mik, misfe, mis), 
m2 = (m2fe, m2s/c, m2s) is sent. Or, more specifically, k,msk, mis and m2s are sent, where k = mik © m2fc 
and msk = misk © rn2sk- 

At receiver 1, i.e., for Pe,i, a decoding error happens if receiver I’s estimate is u^(k), v'^(k, rhsk, m-is, m2s, f) 
with (k,fhsk,'iTiis) ^ (k,msk,rnis). In more details, the error event can be partitioned into the followings: 

1 ) Error event corresponds to k ^ k. Note that this event occurs with arbitrarily small probability if 

Ri+Rr<I(U,V-,Yi) = I(V;Yi). (43) 

2 ) Error event corresponds to k = k, but (mis,rhsk) ^ ('mis,msk) Note that this event occurs with 
arbitrarily small probability if 

Rsk + Ris + Rr<I(V-,Yi\U). (44) 

Similar analysis can be done at the receiver 2 , from which the decoding error probability Pe ^2 can be made 
arbitrarily small if 

R2 + Rr< I(V; Y 2 ) (45) 

Rsk+R2s+Rr<I(V-,Y2\U) (46) 
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Analysis of individual secrecy: Due to the symmetric roles of receiver 1 and receiver 2 , we only need to 
prove the secrecy of one message (e.g., Mi). The proof for the other case (e.g., the secrecy of M2) follows 
similarly. For the secrecy of Mi, we have 

/(Mi;Z") =/(Mife,Mi,fc,Mi,;Z") 

=/(Mife; Z^) + /(Mi,fc, Ml,; Z"|Mifc) 

^=V(Mi,fc,Mi,;Z"|Mife) 

=/(Mi,fc; Z"|Mife) + /(Ml,; Z"|Mifc, Mi,^) 

^=V(Mi,;Z"|Mife,Mi,fc) 

=i/(Mi,) - //(Mi,|Mifc, Mi,fc, Z") 

(c) 

<ni?i, -//(Mi,|Mfe,Z”), 

where (a) is due to the fact that /(Mife;Z”) = 0 by I{Mik;Z'^) < /(Mifc;Z",Mfe) = Mk) = 0, 

which follows by the Markov chain Mi^ —> M^ —)■ Z^; (b) follows the fact that /(Mis^; Z"|Mife) = 0 
as i/(Mi,fc|Z",Mife) > i/(Mi,fc|Z",Mifc,M,fc) = H{Muk\M,k) = H{Muk) = H{Muk\Mik); (c) is due 
to the fact that i/(Mi,|Mifc, Mis^, Z”) > //(Mi,|Mifc, M^, Mis^, Z") = i/(Mi,|Mfc, Z"), where the last 
equality follows as Mik,Misk are independent of Mi, given MkjZ"^, which is due to the Markov chain 

Ml, ^(Z",Mfc)^(Mifc,Mi,fc). 

To complete the proof that /(Mi;Z") < nS'(e), we show in the following that //(Mi,, M2,|Mfc, Z") > 
n(Ris + i?2s) — nS'(e), which implies that //(Mi,|Mfc, Z") > n/?i, — nS'(e). 

i/(Mi„ M2,|Mfc, Z") '=^//(Mi„ M2,|[/", Z") 

=//(Mi,, M2„ Z”|[/”) - //(Z”|[/’^) 

=i/(Mi„ M2,, Z”, y”|C/”) - //CF”|C/", Ml,, M2,, Z”) - i/(Z”|[/”) 

=//(t^”|C/”) + //(Z”|[/”, y”) - //(F”|C/”, Ml,, M2,, Z”) - i/(Z”|C/”) 

(e) 

>n(Rsk + Ris + + -Rr) + nH{Z\U, V) — nH{Z\U) — ne 

*‘=n(/?i, + /?2s) - nS'{e) 

where (d) is due to the fact that D" is uniquely determined by M^; (e) follows by H{V^\U^) = n{Rsk + Ris + 
R2s+Rr) by the codebook construction and the choice of is randomly chosen based on Mk, Mgk, Mis, M2, 
which are presumed to be uniformly distributed; Moreover, since the channel is discrete memoryless, we 
have //(Z”|[/”, F”) = YTi^i H{Zi\Ui, Vi) = nH{Z\U, V); and, H{V^\U^, M^, M2S, Z^) < ne due to Fano’s 
inequality by taking 

Rsk+Rr<I{V-,Z\U)-e', ( 47 ) 
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since the eavesdropper can decode V" reliably by using typical set decoding given ([/”, Mis, M2s, and 
H{Z^\U^) = H{Z,\U,) = nH{Z\U); (/) holds by taking 

Rsk + Rr>HV;Z\U)- 2 e' ( 48 ) 

and S'{e) = e + 2e'. 

Achievable rate region: Combining the followings: 

• the non-negativity for rates, i.e., 

Rk: Rsk T Rls: R2s j Rr 'Z. O 7 

• the rate relations imposed by rate splitting, i.e.. 


Rl — Rk + Rsk + Rls, 
R2 = Rk + Rsk + R 2 s', 


• the constraints for a reliable communication to both legitimate receivers, i.e., ( 43 )-( 46 ): 

Ri+Rr<I{V-Y^), 

R2+Rr<I{V-,Y2), 

Rsk+Rls+Rr<I{V-,Y^\U), 

Rsk+R2s+Rr<I{V-,Y2\U)-, 

• the constraints for individual secrecy of the messages at the eavesdropper, i.e., ( 47 )-( 48 ): 

Rsk + Rr-I{V;Z\U). 


Eliminating Rr, Rk, Rsk, Ris, R2s by applying Fourier-Motzkin procedure [ 47 ], we obtain a region as the 
union of the set of non-negative (i?i,i?2) pairs satisfying 

Ri<min{IiV-,Yi), IiV-,Yi\U) - I{V-, Z\U) + R2}; 


( 49 ) 


R 2 < min{/(E; r2), /(E; Y^lU) - J(E; Z\U) + i?i}. 
where the union is taken over all p{u)p{v\u)p{x\v) subject to I{V-,Yi\U) > I{V;Z\U) for i = 1 , 2 . 


Appendix D 

Discussion on Rate splitting in Superposition Coding 

Rate splitting: As illustrated in Fig. 19 , we represent Mi, M2 by Mi = {Mik, Misk, Mis, Mim) and M2 = 
{M2k,M2sk,M2s,M2m) with Mik,M2k of entropy nRk] Misk,M2sk of entropy nRsk', while Mis,Mim of 
entropy nRis,nRim', and M2s,M2m of entropy nR2s,riR2m, respectively. For simplicity, we denote Mk = 
Mik © M 2 k, Msk = Misk © M 2 sk, Mss = {Mis,M2s) and M«„ = (Mi„, M2^). 
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?77i : 

m2 : 



nRk 


TiRs fc 


nRis 


nRi. 


nRk 


nR. 


nR- 2 . 


nR 2 


Fig. 19: Superposition coding: Rate splitting. 


Codebook generation: Fix p{u),p{v\u) and p{t\v). 

First, randomly generate 2"^'= i.i.d. sequences u'^{k), fc € [1 : 2’^^'“], according to p{u). 

For each u^{k), according to p(u|u), randomly generate j j sequences u”(fc, ssi, SS 2 , sk, r) 

with (ssi,ss 2 ,sA:,r) G [1 : x [1 : x [1 : x [1 : 2^^-]. 

For each fixed u'^{k) and u"(fc, ssi, SS 2 , sk, r), randomly generate i.i.d. sequences t" with 

indices {k, ssi, SS 2 , sfc, r, smi, sm 2 , ri), where (smi, sm 2 , ri) G [1 : 2"^^'"] x [1 : x [1 : 2"^''i], according 

to p{t\v). 

Encoding: To send messages {mi, m 2 ), choose u^{k), where k = mu = mik 0 m 2 k- 

Given u^{k), randomly choose r G [1 : 2"'^’'] and find the corresponding u"(fc,m 2 s,r), where 
rrigk — ^^Isk 0 kfl2sk' 

Given u^{k) and tois, m 2 s, Ws/c, r), randomly choose ri G [1 : 2"'^''i], and send the corresponding 
codeword t" with index (fc,mis,m 2 s,r,m. 2 m, J'l). 

The choice of and t" for given (mi, m 2 ) is illustrated in Fig. 20. 


u"(fc): 

u"'(msfe,mis,m2s,r)|u” : 

t”(TOlm,TO2m,ri)|M", v” : 


nRk 


mik 0 m 2 k 


nRsk nRr 


mis 

misk 0 TO2sfc 

r 

m2s 

nRis 

nR-r^ 


ni?2s 


TTllm 

ri 

m2m 

V— ^ 


V— ^ 


nRi 


ni?2n 


Fig. 20: Superposition coding: Encoding. 


Decoding: Receiver 1, upon receiving y" and with the side information m2, decodes rhi = {m2k®k,m2sk® 
Tdisk,mis,mim), if {k,msk,mis,m2s,f,mirm'kn2m) is the unique tuple such that (rt",D",t”, j/f) is jointly 
typical, where t" are with indices {k,msk,inis,m2s,r,mim,m2mDi)- 

And, receiver 2, upon receiving and with the side information mi, decodes m2 = {mik 0 k,misk 0 
msk,rh2s,rh2m), if {k,msk,mis,m2s,f,mirn,m2rn) is the unique tuple such that u",t”,) is jointly 
typical, where are with indices {k,msk,mis,m2s,r,mim,m2m,fi)- 
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Analysis of decoding error: Assume that mi = (mik, tois, wim), m2 = {m2k, 'm2sk,rn2s, m2m) is sent, 
i.e., more specifically, k, Wsfe, tois, mim and m 2 s, m 2 m are sent, where k = mik®m 2 k and msk = misk(B'rn 2 sk- 
For Pe^i, a decoding error happens if receiver I’s estimate is with indices (fc, mis, m 2 s, rhgfc, f, 

htimj?^ 2 mji^i) such that (fc,mis,m-sfe,f,mim) {k,mis,msk,r,mim)- In more details, the error event can 
be partitioned into the followings: 

1) Error event corresponds to k ^ k. Note that this event occurs with arbitrarily small probability if 

Ri+Rr+Rr, < I{U,V,T;Yi) = I{T;Yi). (50) 

2) Error event corresponds to k = k, but (mis,msfc,r) yf {mis, msk, i") Note that this event occurs with 
arbitrarily small probability if 

Ri-Rk + Rr + Rr^ < I{V,T-,Yi\U) = IiT;Yi\U). (51) 

3) Error event corresponds to (fc, mis, mgfc, f) = {k, mis, msk, r) but mim mim- Note that this event 
occurs with arbitrarily small probability if 

Rim+Rr, <I{T-Yi\U,V)=I{T-Yi\V). (52) 

Similar analysis can be done at the receiver 2, from which the decoding error probability Pe ^2 can be made 
arbitrarily small if 

i?2 + i?r + Rr, < I{T-, Y 2 ) (53) 

R2-Rk+Rr + Rr,<I{T-,Y2\U) (54) 

R2m+Rr,<I{T-,Y2\V). (55) 

Analysis of individual secrecy: Eor the secrecy of Mi , we have 
/(Mi; Z") =I{Mik,Misk, Mis, Mi™; Z") 

=I{Mik,Misk; ^”) + /(Mis, Mi™; ^”|Mifc, Misfc) 
^=V(Mis,Mi™;Z"|Mifc,Misfc) 

=i/(Mis, Mi™) - //(Mis, Mi™|Mifc, Misk,Z^) 

<i/(Mis, Mi™) - //(Mis, Mi™|Mfc, Mik,Misk, Z^) 

= nRis + nRi^ - H{Mis, Mi™|Mfc, Z”) 

where 

(a) is due to the fact that I{Mik, Misk', Z”) = 0 since 

I{Mik, Misk', Z") < I{Mik, Misk', Z", Mk, Msk, Mis, Mim, M2s, M 2 ™) 

= I{Mik, Misk', Aik, Msk, Alls, Mi™, M2 s, M 2 ™) 

= 0 , 
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where the first equality is by the Markov chain (Mi^, M2k, Misk, M2sk) {Mk, Msk, Mgs, Msm) 

(5) is due to the fact that I{Mis, Mi^] Mik, Misk\Z'^, Mk) = 0, where the equality follows by: 

1) Mi^] Mik, Misk\Z'^ , Mk) > 0; and 

2) I{Mis,Mim]Mik,Misk\Z'^,Mk) < 0 since 

H{Mik,Misk\Z'^,Mk,Mis,Mim) > H{Mik, Misk\Z'^, Mk, Msk, Mis, Mim) 

= H{Mik, Misk\Mk, Msk) 

= H{Mik, Misk) 

>H{Mik,Misk\Z^,Mk). 

So far, we obtain 

/(Mi; Z") < nRis + - i/(Mi„ Mi^jMfe, Z"). (56) 

Similarly, for the secrecy of M2, we have 

/(M 2 ; Z") < nR2s + nR2m - H{M2s, M2m\Mk, Z^). (57) 

In the following, we show that H{Mis, Mi^, M2S, M2m\Mk, Z^) > n{Ris + Rim + /?2s + R2m) - nS'{e) 
holds if the rates satisfy (59) and (62). This implies that H{Mis, Mim\Mk, Z^) > Ris + Rim — nS'{e) and 
H{M 2 s, M2m\Mk, Z^) > R 2 s +/? 2 rn — uS'(e) . Further by (56) and (57), we obtain /(Mi;Z”) < nS'{e) and 
I{M2',Z'^) < nS'{e), thus completing the desired individual secrecy proof. 

Note that 

HiMis, Mim, M 2 s, M 2 m\Mk, Z^) 

‘'^H{Mss,Msm\U^,Z'-) 

=H{Mss,Msm, ZP - H{V^\U^, Mss, Msm, ^”) 

>H{Mss,Msm, zp - //(1/"|C/", Mss, zp 

>i/(y"|C/", zp + HiMsmP^, v^, zp - n{Rsk + Rr - pV; Z\U)) - nei, (58) 

where (a) is due to the one-to-one correspondence between Mk and [/"; and the simplification by denoting 
Mss = {Mis,M 2 s) and Mgm = (A/im, M^ 2 rn); (b) follows from [48, Lemma 1] that //(y”|C/", M^g, Z") < 
n{Rsk +Rr- PV; Z\U)) + nei if 

Rsk+Rr>pV-,Z\U) + e. (59) 

For the first term in (58), i.e., //(y”|[/", Z"), we have 

i/(y"|C/”, Z") = H{V^, z^\up - H{Z^\up 

= H{V^\up + H{Z'^\U^, vp - H{z^\up 

= niRis + R2s + Rsk + Rr) + i/(Z"|C/", vp - H{Z^\up-, (60) 
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And, for the second term in ( 58 ), i.e., M2m\U'^,V'^, Z^), we have 

M 2 m\U'^, fo", z^) = H{Ms^\U^, V^, Z") 

=H{Ms^, Z"|C/", fo") - H{Z'^\U^, V^) 

=H{Msm,Z'^,T^\U'^,V^) - H{Z^\U^,V^) - H{T^\U^,V^, Msm, Z'^) 

>i 7 (r"|C/", fo") + HiZ'^lU^, V^, T”) - H{Z^\U^, fo") - H{T^\U^, fo", Z”) 

=niRim + R2m + Rr,) + H{Z^\U^, fo”,T") - H{Z'^\U^, V^) - i/(T"|C/”, fo", M,„, Z") 

> n(i?i™ + R 2 m + Rr^) + HiZ-^lU^, fo”,T") - H{Z^\U'^, V^) - n{Rr, - I{T; Z\U, V)) - nt 2 ( 61 ) 
where (a) follows from [ 48 , Lemma 1 ] that iL(T"|[/", fo", Z'^) < n{Rr^ — I[T] Z\U,V)) + ne2 if 

Rr,> I{T;Z\V) + e. ( 62 ) 

Combining ( 60 ) and ( 61 ) in ( 58 ), we have 
H{Mu, Mi™, M2s, M 2 m\Mk, Z") 

>H{V^\U^, Z”) + iL(Mi™, M 2 m\U^, fo", Z") - n(i?,fc + i?, - /(fo; Z\U)) - nei 
>n{Ris + R2s + Rsk + Rr) + M(Z"|[/", fo") - iL(Z"|[/") 

+ n(i?i™ + + i?rj + M(Z"|[/”, fo", T”) - H{Z^\U^, V^) - n{Rr, - I{T- Z\U, V)) - ne2 

- n{Rsk + Rr - I{V]Z\U)) - nti 

(“) , 

> n(i?i, + i?i™ + R2s + R2m) - nH{Z\U) + nH{Z\U, V, T) + nI{V, T-Z\U) + n 5 '{e) 

=n{Ris + Rim + R2 s + R2m) ~ n 6 '(e) 

where (o) follows from H{Z^\U^) < J 27 =i HiZ^\U^) = nH{Z\U)] H{Z'^\U'^,T^) = nH{Z\U,V,Ty, and 
S'{e) = ei+ € 2 - 

Achievable rate region: Combining the followings: 

• the non-negativity for rates, i.e., 

Rk, Rsk, Rls, R2s, Rr > 0 ; 

• the rate relations imposed by rate splitting, i.e., 

Rl = Rk + Rsk + Rls + Rim, 

R2 = Rk + Rsk + R 2 s + R 2 m', 

• the constraints for a reliable communication to both legitimate receivers, i.e., ( 50 )-( 55 ): 

Rl -f Rr + Rri ^ I{T] Yi) 
i?2 + Rr + Rri ^ I{T] I2) 
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Rx-Rk + Rr + Rr, < I{T; Yi\U) 

R 2 -Rk + Rr+ Rr, < I{T; Y2\U) 

Rim + Rr, < I{T;Yi\V) 

R 2 m + Rr, <HT;Y2\V). 

• the constraints for individual secrecy of the messages at the eavesdropper, i.e., ( 59 ) and ( 62 ): 

Rsk + Rr>HV;Z\U) 

Rr, >/(T;Z|l/). 

Applying Fourier-Motzkin procedure [ 47 ] to eliminate Rk, Rsk, Rim, R2m, Rr, Rri, we get an achievable 
region, which is the union of non-negative (i?i,i?2) pairs satisfying 

<min{/(T;ri)-/(r;Z|y), /(T; Fi jU) -/(T; ZjU) + A2}; ( 63 ) 

i?2 <min{/(T;r2)-/(r;Z|y), IiT;Y 2 \U) - I{T; Z\U) + Ri}, ( 64 ) 

where the union is taken over probability distributions satisfying U ^ V ^ T ^ {Yi,Y2, Z) forming a 
Markov chain and for i = 1, 2 , both /(T; Yi\V) > I{T; Z\V) and /(T; Yi\U) > I{T] Z\U) hold. 

Note that for fixed p{t),p{t\u), the above region is outer bounded by the choice oiV = T, i.e., the outer 
bounding region is given by the union of non-negative (i?i,i?2) pairs satisfying 

i?i <mm{/(y;yi), /(F; Fi jU) -/(M; ZjC/) + i?2}; ( 65 ) 

i?2 <min{/(y;r2), IiV;Y 2 \U) - KV; Z\U) + Ri}, (66) 

where the union is taken over probability distributions satisfying [/ —>■ F —>■ (Yi,F2)^) forming a Markov 
chain and I{V;Yi\U) > I{V;Z\U) holds for i = 1 , 2 . This reduces to the region provided in Theorem 7 . 

Appendix E 

Proof of Converse for Theorem 8 

Consider a BC-RSI with an external eavesdropper. In addition, the eavesdropper’s channel is deterministic 
in the sense that Z is a function of X. For a reliable communication under individual secrecy constraint, we 
have 

nRi =H{Mi) = H{Mi\M 2 ) 

=/(Mi;Fi"|M2) + 77(Mi|M2,Fi") 

(a) 

</(Mi;Fi"|M2)-kne 

where (a) is due to the reliability constraint, i.e., i7(Mi|M2, F") < nei by Fano’s inequality. 
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On one hand, we have 

nRi </(Mi;Y]"|M 2) +ne 

n 

= Y,IiMi;Yu\M2, Yi\-^) + ne 

n 

< I {Mu M2, Yil-^;Yu) + ne 

(b) 

<^/(X,;yH) + ne 

i=l 

(c) 

<nI{X; Fi) + ne 

where ( 5 ) is due to the Markov chain (Mi, M2, —> Yu; (c) is by introducing a time-sharing 

random variable Q which is uniform over 1 , 2 ■ • ■ , n and by taking X = Xq, Yi = Fi^q. 

On the other hand, we have 

nRi </(Mi;Fi"|M 2) -bne 

= /(Mi;Fi"|M 2) - /(Mi; F”|M2) +/(Mi; Z”|M2) +ne. 

'- . -^ ^ ^ 

n-Rf nR( 

The first term i?f can be bounded as follows: 

nRl =/(Mi; Fi"|M2 ) - /(Mi; F”|M2) 

</(Mi; Fi", Z”|M2) - /(Mi; Z”|M2) 

=/(Mi;Fi"|M2 ,F") 

n 

= ^/(Mi;Fi,|M2,Z",Fi(7i) 

n 

< I{Mi,M2, Y,\-\Z{-\Z^^uYu\Z,) 

<J2HX^;Yu\Z,) 

i=l 

(e) 

<n/(X;Fi|F), 

where (d) is due to the Markov chain (Mi, M2, Fi^“^, —5- —>• (Fii,Zi); (e) is by applying the 

time-sharing random variable Q which is uniform over 1 , 2 • • ■ , n and by taking X = Xq, Yi =Yi^q,Z = Zq. 
And the second term i?i can be bounded by 

nR'l =/(Mi;Z”|M2 ) 

</(Mi,M2 ;Z") 

</(M2;Z”|Mi)+ne 
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where {d) is due to the individual secrecy constraint, i.e., /(Mi; Z”) < ne. 

As a conclusion of above discussions, we have as e ^ 0 

i?i < min{/(X;Yi), I{X;Yi\Z) + R2}. 

A similar proof can be applied to R2 and thus completes the proof of the converse. 

Appendix F 
Proof of Theorem 11 

Rate splitting: As illustrated in Fig. 21 , we represent Mi, M2 by Mi = (Mu,, Mist, Miss, Mism) and M2 = 
(M2fe, M2sfe, M2ss,M2sm) with Mifc, M2k of entropy uRt; Misk,M2sk of entropy nRsk', while Miss,Mism of 
entropy nRiss,nRism] and M2ss, M2sm of entropy ni?2ss) n./?2sm, respectively. For simplicity, we denote 
Mfc = Mik © M2fe, Msk = Misk © M2sfe, Mss = {Miss, M2ss) and Msm = {Mism, M2sm)- 

mi : 

m2 : 

Fig. 21 : Martion’s coding: Rate splitting. 

Codebook generation: Fix p{u),p{vo\u),p{vi,V2\vo) and p{x\vi,V2). 

First, randomly generate 2 "^'“ i.i.d. sequences u^{k), fc € [1 : 2 "^'“], according to p{u). 

For each u^{k), randomly generate i.i.d. sequences Uq (fc, miss, m,2ss, i") with 

{miss,m2ss,msk,r) S [1 : x [1 : x [1 : x [1 : 2"'^'’], according to p(wo|m); 

For each fixed VQ{k, miss, m2ss,‘msk, r), randomly generate i.i.d. sequences Vi{k,miss, 

m2ss,msk,r, smi,ri,ci) with (smi,ri,ci) G [1 : 2"^^'’'"] x [1 : 2"^i'’] x [1 : 2"^i‘=], according to p(ui|uo); and 
similarly generate i.i.d. sequences V2{k, miss, m2ss, msk, r, sm2,r2, C2) with {sm2,r2, C2) € 

[1 : 2 "’^^'’"‘] X [1 : 2 "^^''] x [1 : 2 "’^^‘=], according to p{v2\vo). 

Encoding: To send messages (mi, m2), choose u^{k), where k = mk = mik © m2k- 

Given u^{k), randomly choose r G [1 : 2 ”'^''] and find Ug (u", miss, m2ss, msk, f), where msk — misk®m2sk- 

Given (fc, miss, m2ss, msfe, r), randomly choose (ri,r2) G [1 : x [1 : 2 "^ 2 '’], and pick (ci,C2) such 

that Vi{k, miss, m2ss, sk, r, smi, ri, Ci) and V2{k, miss, m2ss, sk, r, sm2, ?’2, C2) are jointly typical. (If there is 
more than one such jointly typical pair, choose one of them uniformly at random. This is possible with high 
probability, if 

Ric + i?2c >/(Fi;F2|Fo) (67) 


nitfc nRsk nRis 


nRis 


mik 

^Isk 

‘^Iss 

'^Ism 


m2k 

R^2sk 

R^2ss 

TR2sni 


nRk nRsk nR2s 


ni?2s 
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(refer to [ 49 ] for the proof). 

Finally, for the chosen jointly typical pair generate a codeword a;" at random according to 

p{x\vi,V2) and transmit it. 

The choice of u",'C q , d”, u2 for given {mi, m2) is illustrated in Fig. 22 . 


u‘^{k) : 


v^{k,miss,m 2 ss,msk,r) : 


v'^{k, miss,m2ss,sk, r, mism, ri,Ci) : 


v^{k, miss,m2ss, sk, r, m2sm, ?'2, C2) : 


nRk 


'mik 0 rn 2 k 



nR„k 

nRr 


'kkLlss 

R^lsk 0 R^2sk 

r 

'kkl2ss 


nR\s 


nR\r "^Rlc 


nR- 2 s 


TRlsm 

ED 

Cl 

‘nRism 

nR2r 

nR2c 

'kkl2sm 

ED 

C2 


ni?2s 


Fig. 22 : Marton’s coding: Encoding. 


Decoding: Receiver 1 , upon receiving y", finds a unique Vi{k,rhiss,m2ss,msk,'r,mism,ri,ci) such that 
{vi,yi) is jointly typical. And, receiver 2 , upon receiving y2, finds a unique V2{k,miss,m2ss,msk,'r,mism, 
r2,C2) such that {v2,y2) is jointly typical. 

Analysis of decoding error: Assume that mi = {mik,misk,miss,misrn), m2 = {m2k,m2sk,m2ss,m2sm) is 
sent, i.e., more specifically, fc, msfe, mi^g, mi^m and m2ss,m2sm are sent, where k = mik (Bm2k and m^fe = 
misk(Bm 2 sk- For Pe,i, a decoding error happens if receiver I’s estimate is u'^{k), Wq (m", mis^,, m2ss, Ws/c, r), 
Vi{vQ,mism,fi,ci) with {k,miss,msk,r,mism,fi,ci) yf {k,mis 8 ,msk,r,mism,ri,ci). In more details, the 
error event can be partitioned into the followings: 

1 ) Error event corresponds to k ^ k. Note that this event occurs with arbitrarily small probability if 

Ri+Rr + Rir + Ric < I{U, Fo, Vi;Yi) = I{Vo, F; F). (68) 

2 ) Error event corresponds to k = k, but (miss, msk,f) yf (miss, m-sfe, r) Note that this event occurs with 
arbitrarily small probability if 

Ri-Rk + Rr + Rir + Ric < I {Vo, Vi-Yi\U). (69) 

3 ) Error event corresponds to (fc, miss, ms/c, r) = {k,miss,msk,r) but (mism,'T i, ci) y^ {mism,ri,Ci). 
Note that this event occurs with arbitrarily small probability if 

Rism + Rir + Ric < I{Vl,Yi\U, Vo) = I{Vi-Yi\Vo). ( 70 ) 
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Similar analysis can be done at the receiver 2 , from which the decoding error probability Pe^2 can be made 
arbitrarily small if 

R 2 +Rr+R 2 r+R 2 c<I{V^,V 2 -,Y 2 ) (71) 

R2-Rk+Rr+ R2r + i?2c < /(K), 1^2 ; >2 |C/) (72) 

R2sm + R2r + R2c < I{V2]Y2\U, Vo) = 1(1^2; ^2 | Fq ) • (73) 

Analysis of individual secrecy: For the secrecy of Mi, we have 

/(Mi; Z”) =IiMik,Misk, Mis^Mum; ^”) 

=I{Mik,Misk-, Z") + /(Ml,,, Ml,™; Z”|Mife, Mi,^) 

'=^/(Mi,„ Ml,™; Z"|Mifc, Mi,fc) 

=H{Miss, Ml,™) — //(Ml,,, Mi,™|Mife, Misk, Z") 

<H{Miss, Ml,™) — //(Ml,,, Mi,™|Mfc, Mik, Misk, ^") 

= nRiss + nRism - H{Miss, Mum\Mk, Z^) 

where 

(a) is due to the fact that I{Mik, Misk] ^") = 0 since 

/(Mife, Misk] Z"^) < I{Mik, Misk] Z"^, Mk, Msk, Miss, Mi,™, M2s,, M2,m) 

= /(Mife, Misfc; Mk, Msk, Miss, Mi,™, M2,s, M2sm) 

= 0 , 

where the first equality is by the Markov chain {Mik, M2k, Misk, M2sk) {Mk, Msk, Mss, Msm) Z"^] 

(b) is due to the fact that /(Mi,,, Mi,™; Mifc, Mi,fc|Z", M^) = 0 , where the equality follows by: 

1 ) /(Mi,,,Mi,™;Mife,Mi,fc|Z”,Mfe) > 0; and 

2 ) /(Mi,,,Mi,™;Mife,Mi,fc|Z”,Mfe) < 0 since 

//(Mife, MisfclZ",Mfe, Ml,,,Ml,™) > //(Mife,Mi,fe|Z"',Mfe,M,fc,Ml,,, Ml,™) 

= //(Mife, Mi,fe|Mfc, Mgfc) 

= H{Mik, Misk) 

>H{Mik,Misk\Z^,Mk). 

So far, we obtain 

/(Mi;Z") <n/ 7 i,,+ni?i,™-//(Mi,,,Mi,™|Mfc,Z"). ( 74 ) 

Similarly, for the secrecy of M2, we have 

/(M2;Z") <n/ 72 ,,+ni? 2 s™-//(M 2 ,,,M 2 ,™|Mfc,Z"). ( 75 ) 
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In the following, we show that H{Miss, M^m, M 2 ss, M2s7n\Mk, Z'^) > n{Ris8+Rism+R2ss+Rism)-n5'[t) 
holds if the rates satisfy (80), (82), (84) and (85). This implies that H{Missi Z^) > Riss + 

Rism - nS'(e) and H{M 2 ss, M 2 sTn\Mk, Z^) > i? 2 ss + R 2 sm - nS'{e). Further by (74) and (75), we obtain 
I{Mi]Z'^) < nS'{e) and I{M 2 ]Z'^) < nS'{e), thus completing the desired individual secrecy proof. 

Note that 

H{Mu8,Mum, M2ss,M2sm\Mk, Z") =H{M8s, Z^) 

=H{Mss, M,™, Fo" I [/", Z") - i7(foo” I [/", Mss , , Z^) 

>H{Mss , Msm,V^\U^,Z^)-H{V^\U^, Mss , ^”) 

>i7(Fo"|C/”, Z^) + i7(M,„|C/”, Fo”, - H{V^\U'^, Mss, ^”). (76) 


We now bound the terms above. 

For the first term in (76), i.e., H{V^\U'^^ Z"^), we have 


i 7 (Fo”|C/", Z”) = H{V^, Z”|C/") - i 7 (Z”|C/") 

= i7(Fo”|C/”) + HiZ^p'^, Fo”) - i7(Z”|C/”) 

= n{Riss + R2ss + Rsk + Rr) + i7(Z”|C/", Fo”) - i7(Z”|[/”); (77) 

And, for the second term in (76), i.e., i7(Mism, A72sm|C7", Fq”, Z"), we have 


t/” 

’ *^0 


i 7 (Mi,„,M 2 .„,|[/”,Fo”,Z”) 

=H{Mum, M2sm, Z^\U^, Fp”) - i7(Z”|C/”, 

=HiMum, M2sm, F^”, V^\U^, Fp”) - i7(Z”|C/”, 

=J7(Z”, F”, F2”|C/”, Fo”) - i7(Z”|C/", Fp”) - i7(F”, F2”|C/”, Fp”, Mi,„, M; 
=i7(Z”|C/”, Fp”, Fi”, F 2 ”) + i7(Fi”, F2”|C/’ 


Fo”) - i7(Fi”, F2”|C/”, Fo”, Mi,™, M 2 ,™, Z”) 


sm,M2,m,Z”) 

-.n- I- ,ro ,.2 ,^2 I- , Fp”) - i7(Z”|C/”, Fp”) - M(Fi”, F2”|C/”, Fp”, Mi,™, M 2 ,™, Z”) 

>M(Z”|C/”, Fp”, Fi”, F 2 ”) + i7(Fi”, F2”|C/”, Fp”) - i7(Z”|C/”, Fp”) 

- i7(F”lC/”,Fn”,Ml,™,M2.,™,Z”) - M(F2”|C/”,Fn”,Mi,™,M2.,™,Z”) 


>i7(Z”|C/”, Fp”, Fi”, F 2 ”) + n{Rism + Rlr + i?2.™ + R2r) " i7(Z”|C/”, Fp”) 
- i7(F”|C/”, Fp”, Mum, Z”) - i7(F2”|C/”, Fp”, M 2 ,™, Z”) 

>i7(Z”|C/”, Fp”, Fi”, F 2 ”) + n{Rum + Rlr + R 2 sm + R 2 r) " i7(Z”|C/”, Fp”) 


- n(i?ir + Ric - /(Fi;Z|Fo)) - nei - n(i?2r + 7?2c - 7(F2; Z|Fo)) - nei 


(78) 


where (a) is due to the fact that H{A,B\C) < H{A\C) + H{B\C), (6) follows as 


M(Fi”, F 2 ”|C/”, Fp”) = H{Mum, M 2 ,™, Mu, M 2 ,|C/”, Fp”) + M(Fi”, V^U^, Fp”, Mi,™, M 2 ,™, Mi™ M 2 .) 

> M(Mi,™,M 2 ,™,Mi.,M 2 .|C/”,Fo”) = H{Mum,M2sm,Mu,M2r) 
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— Tl[Rlsm “t“ Rlr “t“ R2sm “t“ R2r) 

since the choice of Mism, M2sm, Mir, M2r are independent of C/", (c) is due to the followings: First, we 


have 

H{Vi^\U^, Vo^, Mism, z^) = H{Vi^\Vo^, Z^) < n(i?i, + i?i, - I{Vi;Z\Vo)) + nei (79) 
if, for an arbitrarily small e > 0, 

Rir + Ric>I{Vi-,Z\Vo) + e. (80) 

This follows from [48, Lemma 1]. And, similarly, we have 

i7(vg*|c/", KT, M2sm, Z^) = H{V^^\Vo^, M2sm, ^”) < n(i?2r + i?2c " I{V2-,Z\Vo)) + uei (81) 

if, for an arbitrarily small e > 0, 

R 2 r + R 2 c>IiV 2 ;Z\Vo) + e. (82) 

Finally, for the last term in (76), i.e., H{V^\U'^, Mss, Z'^), we have 

H{Vo^\U^,Mss,Z^)<niRsk + Rr-HVo-,Z\U)) + nei, (83) 

if, for an arbitrarily small e > 0, 

Rsk + Rr>I{Vo-,Z\U) + e. (84) 


This follows from [48, Lemma 1]. 

Combining (77), (78) and (83) in (76), we have 

H{Miss, Mism, M2 ssi M2sm\Mk, •Z'") 

>H{V^\U'^, Z") + H{Ms^\U^, V^, Z") - H{V^\U'^, Z") 

>n(i?i,, + R2ss + Rsk + Rr) + H{Z^\U^, V^) - H{Z^\U^) 

+ H{Z^\U^, y”, C 2 ”) + n{Ris^ + Rlr + R2sm + R2r) " H{Z^\U^, 

- n{Rir + Ric - I{Vi;Z\Vo)) - nei - n{R2r + i?2c - 7(^2; ^jhb)) - nei 

- n{Rsk + Rr - I{Vo;Z\U)) - nei 

(а) 

^Tl{Riss T Rlsm T R 2 SS “t” R2sm) 

+ n{-Rir - i?2c - H{Z\U) + H{Z\U, Vo, Fi, 1 ^ 2 ) + /(Ci; Z|l/o) + /(f4; Zl^o) + HVo; Z\U) - 3ei) 

( б ) 

^Tl{Riss T Rlsm “t” R 2 SS “t” R2sm) Tn5(e) 

where (a) follows from i7(Z"|[/") < J27=i H{Zi\Ui) = nH{Z\U) and the fact that i7(Z"|[/”, Vf^, C”, V^) = 
ni7(Z|[/, Vb, Vi, V 2 ); and (5) follows by the rate choice 

Rlr + i?2c < HVi; Z\Vo) + I{V 2 ;Z\Vo) - /(Ci, ^ 2 ; Z|l/o) (85) 


February 26, 2015 


DRAFT 



48 


with S(e) = 3 ei. 

Achievable rate region: Combining the non-negativity for rates, the conditions for reliable communication 
at both legitimate receivers, i.e., ( 67 ), ( 68 )-( 73 ), and individual secrecy at the eavesdropper, i.e., ( 80 ), ( 82 ), 
( 84 ) and ( 85 ), we obtain the followings: 


Rski Rlssi Rlsm 

1 R2ss-! R2smj Rri Rlc-, ^2c; Rlr-, R2r ^ 0 

(86) 

Rl 

= 

Rk + Rsk + Rlss + Rlsm 

(87) 

R 2 

= 

Rk + Rsk + R 2 SS + R2sm 

(88) 

Rlc + R2c 

> 

HVrV2\Vo) 

(89) 

Rl + Rr Rlr Rlc 

< 

nVo,VrY,) 

(90) 

Rk + Rr Rlr Rlc 

< 

I{Vo,Vi;Y,\U) 

(91) 

Rlsm Rlr “1“ Rlc 

< 

IiVi;Yi\Vo) 

(92) 

R 2 Rr R2r R 2 C 

< 

IiVo,V2-,Y2) 

(93) 

Rk + Rr + R2r + R2c 

< 

IiVo,V2-,Y2\U) 

(94) 

R2sm + R2r + ^2c 

< 

I{V2;Y2\Vo) 

(95) 

R'sk R^r 

> 

I{Vo;Z\U) 

(96) 

Rlr H” Rlc 

> 

I{Vi;Z\Vo) 

(97) 

i?2r + R2c 

> 

nV2;Z\Vo) 

(98) 

Rlc H" R2c 

< 

I{Vr Z\Vo) + I{V 2 ;Z\Vo) - /(Fi, F; ^|Fo), 

(99) 


where the union is taken over probability distributions satisfying 

p{q, u, Vo,Vi,V2,x) = p{q)p{u\q)p(vo\u)p{vi,V2\vo)p{x\vi,V2). 

Eliminating Ric, R 2 c, Rir, R 2 r, Rr, Rism, R 2 sm, Riss, R 2 ss, Rk, Rsk, by applying Fourier-Motzkin proce¬ 
dure [ 47 ], we obtain the region of (i?i,i?2) as given in ( 20 ) in Theorem 11 . Note that a sketch of this 
Fourier-Motzkin procedure is provided in Appendix G. 

Appendix G 

Fourier-Motzkin Elimination for Theorem 11 
Here we briefly outline the Fourier-Motzkin procedure in the proof of Theorem 11 . 

• To eliminate Riss, we consider the non-negativity of the rate and the equality ( 87 ) 

Rlsm + Rk + Rsk £ Rl 


. We end up with 
( 100 ) 
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• To eliminate i? 2 ss, we consider the non-negativity of the rate and the equality ( 88 ). We end up with 

R2sm + Rk + Rsk £ R 2 (101) 

• To eliminate Rism, we consider the non-negativity of the rate and the inequalities (92) and (100) which 
involve Rism- We end up with 

Rir + Ric < HVi;Yi\Vo) (102) 

Rk + Rsk ^ Ri (103) 

• To eliminate i? 2 sm, we consider the non-negativity of the rate and the inequalities (95) and (101) which 
involve i? 2 sm- We end up with 

R2r + R2 c < HV2;Y2\Vo) (104) 

Rk + Rsk ^ R 2 (105) 

• To eliminate Rr, we consider the non-negativity of the rate and the inequalities (90), (91), (93), (94), 


(96) which involve Rr- We end up with 

Ri+Rir + Ric<IiVo,Vi;Yi) (106) 

Ri-Rk + Rir + Ric < I {Vo, Vi-,Yi\U) (107) 

R2+R2r + R2c<I{Vo,V2-,Y2) (108) 

R2-Rk+ R2r + R2c < I{Vo, 1 / 2 ; Y 2 \U) (109) 

i?i - Rsk + Rir + Ric < I {Vo, Id; Ti) - I {Vo; Z\U) (110) 

Ri-Rk- Rsk + Rir + Ric < I{Vo, Vi;Yi\U) - I{Vo; Z\U) (111) 

i?2 - Rsk + R2r + R2c < I{Vo, Id; Y 2 ) - I {Vo; Z\U) (112) 

R2-Rk- Rsk + R2r + R2c < I{Vo, Id; Y 2 \U) - I{Vo; Z\U) (113) 

• To eliminate Rk, we consider the non-negativity of the rate and the inequalities (107), (109), (111), 
(113), (103), (105) which involve Rk- We end up with 

Rsk < Ri (114) 

Rsk < i?2 (115) 

Rsk + Rir + Ric<I{Vo,Vi;Yi\U) (116) 

R 1 -R 2 + Rsk + Rir + Ric < I{Vo, Vi;Yi\U) (117) 

R 2 -R 1 + Rsk + R2r + R2c < I{Vo, hd; Y 2 \U) (118) 

Rsk+R2r + R2c<I{Vo,V2;Y2\U) (119) 

Rir + Ric < I{Vo, Vi;Yi\U) - I{Vo; Z\U) (120) 
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( 121 ) 
( 122 ) 
(123) 

• To eliminate Rsk, we consider the non-negativity of the rate and the inequalities (110), (112), (114), 
(115), (116), (117), (118), (119) which involve Rsk- We end up with the following inequalities after 


cancelling the redundant ones. 

i?i > 0 (124) 

i?2 > 0 (125) 

• To eliminate Rir, we consider the non-negativity of the rate and the inequalities (97), (106), (102), (120), 
(121) which involve Rir- We end up with the following inequalities after cancelling the redundant ones. 

Ri+Ric<I{Vo,Vi;Yi) (126) 

Rlc < I{Vi;Yi\Vo) + [I {Vo; W |17) - I {Vo; Z\U)]- (127) 

R 1 -R 2 + Rlc < I{Vo, Vi;Yi\U) - I{Vo; Z\U) (128) 

Ri<I{Vo,Vi;Yi)-I{Vi;Z\Vo) (129) 

I{Vi;Z\Vo)<I{Vi;Yi\Vo) (130) 

I{Vo,Vi;Z\U)<I{Vo,Vi;Y,\U) (131) 

Ri-R2< I {Vo, Vi;Yi\U)- I {Vo, Vr,Z\U) (132) 

where [a]“ = min{0,a}. 

• To eliminate R 2 r, we consider the non-negativity of the rate and the inequalities (98), (108), (104), 


(122), (123) which involve i? 2 r- We end up with the following inequalities after canceling the redundant 


ones. 

R2 + R2c<I{Vo,V2;Y2) (133) 

R2c < I{V2;Y2\Vo) + |/(1/o; 4"2|C/) -/(l/o;^|C/)|- (134) 

R 2 -R 1 + R 2 c < I{Vo, 1 / 2 ; Y 2 \U) - I{Vo; Z\U) (135) 

R2<I{Vo,V2;Y2)-I{V2;Z\Vo) (136) 

I{V2;Z\Vo)<I{V2;Y2\Vo) (137) 

I{Vo,V2;Z\U)<I{Vo,V2;Y2\U) (138) 

R2-Ri<I{Vo,V2;Y2\U)-I{Vo,V2;Z\U) (139) 


• To eliminate Ric, we consider the non-negativity of the rate and the inequalities (89), (99), (126), (127) 
and (128) which involve Ric- We end up with the following inequalities after canceling the redundant 


February 26, 2015 


DRAFT 



ones. 


51 


i?2c < /(^i; Z\Vo) + I{V2;Z\Vo) - I{Vi,V2-, Z\Vo) (140) 

I{Vi; V2\Vo) < /(Fi; Z\Vo) + I{V2;Z\Vo) - /(Fi, ^ 2 ; Z\Vo) (141) 

Ri - R2 c < I {Vo, Fi; Yi) - I{Vi-V2\Vo) (142) 

R2c > I{Vi-,V2\Vo) - I{Vi-,Yi\Vo) - [I{Vo-,Yx\U) - I{Vo-,Z\U)]- (143) 

R 1 -R 2 - R 2 c < I {Vo, Yi; Yi|C/) - I {Vo; Z\U) - J(Yi; Y 2 IY 0 ) (144) 


• To eliminate i? 2 c, we consider the non-negativity of the rate and the inequalities (133), (134), (135), 
(140), (142), (143), (144) which involve i? 2 c- We end up with the following inequalities after cancelling 


some redundant ones. 

i?i + i ?2 </(Yo,Yi;Yi)+/(Yo,Y2;Y2)-/(Yi;Y2|Yo) (145) 

Ri < /(Yo, Yi; Yi) -/(Yi; Y2IY0) +/(Y2;Y2|Yo) + [/(Yq; Y 2 |[/) -/(Yq; Z| 17 )]- (146) 

i?2 < I{Vo, Y2; Y2|17) - /(Yi; Y2IY0) - /(Yq; Z\U) + I{Vo, Yi; Yi) (147) 

Ri < I {Vo, Yi; Yi) - /(Yi; Y2IY0) + /(Yi; Y|Yo) + /(Y2; Z|Yo) - /(Yi, Y2; Z|Yo) (148) 

i ?2 < /(Yo, Y2; Y2) -/(Yi; Y2IY0) +/(Yi;Yi|Yo) + [/(Yq; Yi |[/) -/(Yq; Z| 17 )]- (149) 

i?2 - i?i < /(Yo, Y2; Y 2 | 17 ) -/(Yi; Y2IY0) -/(Yo;Z| 17 ) + /(Yi; YilYo) 

+ [I{Vo;Y,\U)-I{Vo;Z\U)]- (150) 

Ri < /(Yo, Yi; YilU) - /(Yi; Y2IY0) - /(Yq; Z\U) + /(Yo, Y2; Y2) (151) 

i?i - i?2 < I {Vo, Yi; Yi lU) + /(Y2; Y2I Yo) - /(Yi; Y2I Yo) - I {Vo; Z\U) 

+ [I{Vo;Y2\U)-I{Vo;Z\U)]- (152) 

i?i - i?2 < I {Vo, Yi; YilU) - /(Yi; Y2IY0) - I {Vo; Z\U) 

+ I{Vi;Z\Vo) + /(Y2; Z|Yo) - /(Yi, Y2; Z|Yo) (153) 


Note that (145) is redundant due to (129), (136) and (141); (147) is redundant due to (139), (129) and 
(141); (148) is redundant due to (129) and (141); (150) is redundant due to (139), (130) or (131), and 
(141); (151) is redundant due to (132), (136) and (141); (152) is redundant due to (132), (137) or (138), 
and (141); (153) is redundant due to (132) and (141). 

So far, we have for Ri the inequalities (124), (129), (132), (146) and for R 2 the inequalities (125), (136), 
(139), (149). An individual secrecy rate region is obtained as a set of the non-negative rate pairs (i?i,i? 2 ) 
snch that 

Ri <min{/(Yo,Yi;Yi)-/i, /(Yo, Yi; Yi |17) -/(Yo, Yi; Z|17) + i?2}; 

R2 < min{/(Yo, Y2; Y2) - I2, /(Yo, Y2; Y2|17) - /(Yo, Y2; Z\U) + i?i}. 
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/i =max{/(yi;Z|yo), I{Vi-,V2\Vo) - I{V2-,Y2\Vo), /(^i; I/2IK)) +^|C/) -/(K), 1^2; >^2|C/)}; 

/2 =max{/(F2;Z|yo), I{Vi-V2\Vo)-I{VuY^\V^), I{Vi-V2\Vo) + I{V^-,Z\U)-I{Vo,V^-Y^\U)}, 

Note that [/ —>■ Vb ^ (Vi, V 2 ) —>■ (hi, F 2 , Z) forms a Markov chain such that (130), (131), (137), (138), (141) 

hold. Further, we notice that /i = /(Vi;Z|Vb) since 

(a) (b) 

I{Vr,V2\Vo) - I{y2-,Y2\V^) < /(l^i;M2|Mo)-/(Vb;^|Mo) < I{V^-Z\V^)-, 

(c) (6) 

/(V7;'F2|Mo)+/(yo;^|t/)-/(14o,'F2;M2|t/) < /(Mi; VbiMo) +/(Mq; ^|C/) -/(Vb, M 2 ; Z|C/) < /(Mi;Z|Mo), 

where (a) is due to (137); (5) is due to (141); and (c) is due to (138). Similarly, we have I 2 = /(M 2 ;Z|Mo). 

Thus the region could be simplihed into 

Ri <min{/(Mo, Mi; Mi) - /(Mi; Z|Mo), /(Mq, Mi;Mi|C/) - /(Mo, Mi; M|C/) + R 2 } 

=/(Mo, Mi; Mi|C/) - /(Mo, M; Z|C/) + min{i? 2 , /(C/; Mi) + /(Mo; M|C/)}; 
i?2 < min{/(Mo, M 2 ; M 2 ) - /(M 2 ; M|Mo), /(Mo, M 2 ; M 2 |t/) - /(Mo, M 2 ; M|C/) + /7i} 

=/(Mo, M 2 ; Y 2 \U) - /(Mo, M 2 ; M|C/) + min{i?i, /([/; M 2 ) + /(Mo; Z\U)}. 

This is the desired region in (20) in Theorem 11. 
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